Quantum Audit Logo

Is TermMax a Scam?

Early-stage security check — honeypot & rug-pull analysis

Is this your token? Publish your own audit on this page →

TermMax TMX
0x3c2f…0039
BNB Chain Not verifiedLast checked 3d ago 1 audit on record New Launch · 5d old
DexScreener ↗
How is this score calculated? → Medium Risk
Executive SummaryAI Copilot

This security review was conducted on the provided Solidity interface definitions for LayerZero V2 components, including `ILayerZeroEndpointV2` and related messaging interfaces. No concrete contract implementations were provided for analysis, which significantly limits the scope of this audit. The prefill indicated 'MyOFT' as a contract name, but no source code for 'MyOFT' was available. Therefore, the analysis focuses on the architectural implications, design patterns, and potential security considerations derived from the interface definitions. A comprehensive security assessment, including identification of implementation-specific vulnerabilities, requires the full source code of all deployed contracts.

3 Low3 Informational
! Early-stage analysis. This token has limited on-chain history (5d old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.
Volume 24h
$33.7K
Liquidity
$7.8K
Price
$0.1087
Token Age
5d
Top 10 Holders
0.0%

Security Findings

3 Low3 Info
Low

Design Implies Critical Administrative Functions

L-01The interfaces define numerous highly sensitive administrative functions, such as `registerLibrary`, `setDefaultSendLibrary`, `setDefaultReceiveLibrary`, `setSendLibrary`, `setReceiveLibrary`, `setLzToken`, and `setDelegate`. These functions control core aspects of the LayerZero messaging system, including library registration, default message routing, and critical token/delegate settings (7.3 Access Control, 7.8 Operations).
IssueThe interfaces define numerous highly sensitive administrative functions, such as `registerLibrary`, `setDefaultSendLibrary`, `setDefaultReceiveLibrary`, `setSendLibrary`, `setReceiveLibrary`, `setLzToken`, and `setDelegate`. These functions control core aspects of the LayerZero messaging system, including library registration, default message routing, and critical token/delegate settings (7.3 Access Control, 7.8 Operations).
FixAny implementation of these interfaces *must* incorporate robust, multi-layered access control mechanisms (e.g., multi-signature wallets, role-based access control, time-locks) to prevent unauthorized modifications that could compromise the entire system's integrity or lead to fund loss.
StatusUnresolved
Low

Payable Functions Require Reentrancy Protection

L-02Several critical functions, including `send`, `lzCompose`, and `lzReceive`, are declared as `payable`. This indicates that they are designed to handle native token transfers. In an implementation, any interaction with external contracts or token transfers within these payable functions could introduce reentrancy vulnerabilities if not properly mitigated (7.2 Code Security, 7.4 Economic).
IssueSeveral critical functions, including `send`, `lzCompose`, and `lzReceive`, are declared as `payable`. This indicates that they are designed to handle native token transfers. In an implementation, any interaction with external contracts or token transfers within these payable functions could introduce reentrancy vulnerabilities if not properly mitigated (7.2 Code Security, 7.4 Economic).
FixImplementations of these payable functions should strictly adhere to the Checks-Effects-Interactions pattern and utilize reentrancy guards (e.g., OpenZeppelin's `ReentrancyGuard`) to prevent malicious reentrant calls.
StatusUnresolved
Low

Extensive External Calls Increase Attack Surface

L-03The LayerZero V2 architecture, as implied by the interfaces, involves extensive interactions between the endpoint, message libraries, and receiver contracts. Functions like `send`, `lzReceive`, and `setConfig` inherently involve calls to external, potentially untrusted, contracts. This high degree of inter-contract communication increases the overall attack surface and complexity, making the system more susceptible to issues arising from malicious or buggy external contracts (7.2 Code Security, 7.6 External).
IssueThe LayerZero V2 architecture, as implied by the interfaces, involves extensive interactions between the endpoint, message libraries, and receiver contracts. Functions like `send`, `lzReceive`, and `setConfig` inherently involve calls to external, potentially untrusted, contracts. This high degree of inter-contract communication increases the overall attack surface and complexity, making the system more susceptible to issues arising from malicious or buggy external contracts (7.2 Code Security, 7.6 External).
FixImplementations should carefully validate all inputs and outputs from external calls. Consider using call limits, gas stipends, and robust error handling for external interactions. Thorough testing of all possible interaction paths, especially with edge cases and malicious external contracts, is crucial.
StatusUnresolved
Info

Audit Scope Limited to Interface Definitions

I-01The provided source code consists solely of Solidity interface definitions for LayerZero V2 components (e.g., `ILayerZeroEndpointV2`, `IMessageLibManager`). No concrete contract implementations were provided for analysis. This significantly limits the scope of the audit, as common vulnerabilities such as reentrancy, integer overflows/underflows, and specific access control flaws cannot be identified without the actual contract logic (7.2 Code Security).
IssueThe provided source code consists solely of Solidity interface definitions for LayerZero V2 components (e.g., `ILayerZeroEndpointV2`, `IMessageLibManager`). No concrete contract implementations were provided for analysis. This significantly limits the scope of the audit, as common vulnerabilities such as reentrancy, integer overflows/underflows, and specific access control flaws cannot be identified without the actual contract logic (7.2 Code Security).
FixProvide the full source code for all relevant contract implementations to enable a comprehensive security audit.
StatusUnresolved
Info

Grace Periods for Receive Library Changes

I-02The `setDefaultReceiveLibrary` and `setReceiveLibrary` functions include a `_gracePeriod` parameter, allowing for a delayed activation of new receive libraries. This mechanism provides a time window for users or governance to react to potentially malicious or erroneous library changes, enhancing security and operational safety (7.8 Operations, 7.5 Governance).
IssueThe `setDefaultReceiveLibrary` and `setReceiveLibrary` functions include a `_gracePeriod` parameter, allowing for a delayed activation of new receive libraries. This mechanism provides a time window for users or governance to react to potentially malicious or erroneous library changes, enhancing security and operational safety (7.8 Operations, 7.5 Governance).
FixContinue to utilize and enforce grace periods for all critical configuration changes where feasible, especially those that could impact user funds or system integrity.
StatusUnresolved
Info

Dynamic Configuration via `setConfig`

I-03The `IMessageLibManager` and `IMessageLib` interfaces define `setConfig` and `getConfig` functions, allowing for dynamic configuration of message libraries. This provides significant flexibility for adapting the system to various requirements and evolving protocols. However, dynamic configuration also introduces complexity and the potential for misconfiguration if not managed with extreme care (7.1 Architecture, 7.8 Operations).
IssueThe `IMessageLibManager` and `IMessageLib` interfaces define `setConfig` and `getConfig` functions, allowing for dynamic configuration of message libraries. This provides significant flexibility for adapting the system to various requirements and evolving protocols. However, dynamic configuration also introduces complexity and the potential for misconfiguration if not managed with extreme care (7.1 Architecture, 7.8 Operations).
FixImplementations should ensure that `setConfig` is protected by stringent access control. All configuration parameters should be thoroughly validated before application. Consider implementing a robust testing framework for configuration changes and potentially a multi-stage approval process for critical updates.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The technical architecture, as defined by the interfaces (7.1 Architecture), demonstrates a modular and extensible design for cross-chain messaging. Key strengths include explicit grace periods for critical configuration changes, such as `setDefaultReceiveLibrary`, which enhances operational safety. However, the design also implies a high degree of inter-contract complexity (7.2 Code Security) due to extensive external calls to message libraries and receiver contracts, increasing the attack surface. Critical administrative functions like `registerLibrary` and `setLzToken` (7.3 Access Control) are defined, necessitating robust access control in any implementation.

GovernanceHigh3/10

The interfaces define functions that directly impact economic aspects (7.4 Economic), such as `quote` and `send` for fee calculation and message transmission, and `setLzToken` for managing the LayerZero token. The presence of payable functions (`send`, `lzCompose`, `lzReceive`) indicates native token handling, which requires careful implementation to prevent economic exploits. Governance (7.5 Governance) is implied through administrative functions that control core system parameters, emphasizing the need for secure governance mechanisms to manage these critical settings.

UpgradesMedium6/10

The modular design, with distinct interfaces for message libraries (`IMessageLibManager`, `IMessageLib`), suggests a flexible architecture that can accommodate future upgrades or changes (7.7 Upgrades) by swapping out library implementations. The use of grace periods for receive library changes further supports a safer upgrade path for critical components. However, the interfaces themselves do not explicitly define an upgrade mechanism (e.g., proxy patterns), which would be a crucial consideration for the concrete implementations.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Liquidity Depth

$13.0K across 6 pairs
UniswapUSDTanalysed$7.8K59.8%UniswapUSDT$4.2K32.1%Pancakeswap v3USDT$6675.1%Pancakeswap v3USDT$3853.0%UniswapUSDT$110.1%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

Key Addresses

1 addresses
Deployer
0x1c59…976f

What Raised This Score

5 factors
  • Ownership NOT renounced — strong Multisig (5-of-6)
  • Liquidity NOT locked (owner can withdraw — rug-pull risk)
  • Liquidity < $50k ($13,022 across 6 pairs — thin market)
  • Token age < 7 days (early, volatile)
  • 3 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Baby Doge Coin (BABYDOGE)Medium RiskMindNetwork FHE Token (FHE)Medium RiskOrochi Network Token (ON)Medium RiskZestMedium RiskAPRO oracle Token (AT)Medium Riskutility token (UTILITY)Medium Risk

Would You Like a More Detailed Audit of TermMax?

This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.

Get Detailed Audit