Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Unitas Safe?

UPBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance2/10Upgrades7/10Checks passed3 of 5Findings2 High · 1 Medium · 2 Info5
SummaryAI Copilot

The UnitasOFT contract is an Omnichain Fungible Token (OFT) built on LayerZero v2, inheriting from LayerZero's OFT and OpenZeppelin's Ownable contracts.

Read the full analysis
What raised the score
  • Ownership not renounced — strong Multisig
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Volume/Liquidity > 15×
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit
Exact factors
  • Ownership NOT renounced — strong Multisig (3-of-5)
  • Top-10 concentration > 30% (98.0% total → 42.4% effective; 5.3% in EOAs, 92.7% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Volume/Liquidity > 15× (24.1× — wash-trading signal)
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 55% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 55% of DEX liquidity)
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
92.7%Contracts5.3%2.0%
92.7%Contracts5.3%
ContractsWalletsEveryone elseBubble area = share of supply
98.0%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking92.7%
  • Walletsanonymous holders, free to sell5.3%
  • Everyone elsethe rest of the supply2.0%
Effective concentrationwhat the score reads42.4%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$1.33M across 8 pairs
Show 2 more pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$725.0KShare of depth54.5%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x0144…69c60xc7e2…e64f0x592e…9318

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

2 High1 Medium2 Info
High

Centralization of Control by Owner Multisig

The UnitasOFT contract inherits Ownable, granting a single owner address (a 3/5 multisig) extensive administrative control. This owner can configure critical LayerZero parameters such as setPeer, setSendVersion, setReceiveVersion, setConfig, setPrecrime, setOracle, setFeeCollector, and setTreasury through the inherited OFT and OApp functions. Malicious or erroneous actions by the multisig signers could lead to severe consequences, including disabling cross-chain transfers, redirecting fees, or compromising the integrity of the token bridge.H-01

Issue

The UnitasOFT contract inherits Ownable, granting a single owner address (a 3/5 multisig) extensive administrative control. This owner can configure critical LayerZero parameters such as setPeer, setSendVersion, setReceiveVersion, setConfig, setPrecrime, setOracle, setFeeCollector, and setTreasury through the inherited OFT and OApp functions. Malicious or erroneous actions by the multisig signers could lead to severe consequences, including disabling cross-chain transfers, redirecting fees, or compromising the integrity of the token bridge.

Fix

Ensure the multisig signers are highly trusted individuals, and that robust internal governance procedures, including strict review and approval processes, are in place for all administrative actions. Consider implementing a timelock for critical operations to provide a window for community review or emergency intervention.

Status

Unresolved

High

Reliance on LayerZero Protocol Security

As an Omnichain Fungible Token (OFT) built on LayerZero v2, the contract's cross-chain functionality is entirely dependent on the security and operational integrity of the LayerZero protocol. This includes the security of LayerZero endpoints, relayers, oracles, and precrime mechanisms. Vulnerabilities or exploits within the LayerZero infrastructure, or issues with external actors (e.g., relayers censoring messages, oracles providing incorrect data), could directly impact the UnitasOFT token, potentially leading to loss of funds, frozen assets, or incorrect state synchronization across chains.H-02

Issue

As an Omnichain Fungible Token (OFT) built on LayerZero v2, the contract's cross-chain functionality is entirely dependent on the security and operational integrity of the LayerZero protocol. This includes the security of LayerZero endpoints, relayers, oracles, and precrime mechanisms. Vulnerabilities or exploits within the LayerZero infrastructure, or issues with external actors (e.g., relayers censoring messages, oracles providing incorrect data), could directly impact the UnitasOFT token, potentially leading to loss of funds, frozen assets, or incorrect state synchronization across chains.

Fix

While direct mitigation within the UnitasOFT contract is limited, it is crucial to stay updated on LayerZero's security announcements and best practices. Implement robust monitoring for LayerZero-related events and transactions. Consider diversifying cross-chain solutions or implementing circuit breakers if the protocol's design allows for such measures in case of a LayerZero-wide incident.

Status

Unresolved

Medium

Risk of Owner Misconfiguration

The owner multisig has the ability to configure various LayerZero parameters. Incorrectly setting these parameters, such as an invalid peer address, an unsupported sendVersion or receiveVersion, or an erroneous config for a specific eid, could lead to cross-chain messages failing, tokens becoming stuck on a particular chain, or unintended behavior. While the owner is a multisig, human error or a lapse in judgment during configuration remains a risk.M-01

Issue

The owner multisig has the ability to configure various LayerZero parameters. Incorrectly setting these parameters, such as an invalid peer address, an unsupported sendVersion or receiveVersion, or an erroneous config for a specific eid, could lead to cross-chain messages failing, tokens becoming stuck on a particular chain, or unintended behavior. While the owner is a multisig, human error or a lapse in judgment during configuration remains a risk.

Fix

Implement a rigorous testing and verification process for all LayerZero configuration changes before deployment to production. Utilize a staging environment to simulate changes and ensure they function as expected. Document all configuration parameters and their intended values.

Status

Unresolved

Info

Non-Upgradeable Contract

The UnitasOFT contract is deployed as a standard implementation contract and is not designed to be upgradeable via proxy patterns. This means that once deployed, its logic cannot be modified. Any future bug fixes, feature enhancements, or protocol changes would necessitate deploying an entirely new contract and migrating existing token holders, which can be a complex and costly process.I-01

Issue

The UnitasOFT contract is deployed as a standard implementation contract and is not designed to be upgradeable via proxy patterns. This means that once deployed, its logic cannot be modified. Any future bug fixes, feature enhancements, or protocol changes would necessitate deploying an entirely new contract and migrating existing token holders, which can be a complex and costly process.

Fix

Acknowledge the implications of a non-upgradeable contract. For critical infrastructure, consider the long-term implications of immutability versus the flexibility of upgradeability. If future upgrades are anticipated, a proxy pattern might be considered for future iterations.

Status

Unresolved

Info

Minimal Custom Logic

The UnitasOFT contract primarily acts as a wrapper, inheriting functionality from OFT and Ownable without introducing significant custom logic or state variables beyond the constructor. While this reduces the attack surface for new vulnerabilities within UnitasOFT itself, it means that the security profile is largely determined by the underlying LayerZero and OpenZeppelin libraries.I-02

Issue

The UnitasOFT contract primarily acts as a wrapper, inheriting functionality from OFT and Ownable without introducing significant custom logic or state variables beyond the constructor. While this reduces the attack surface for new vulnerabilities within UnitasOFT itself, it means that the security profile is largely determined by the underlying LayerZero and OpenZeppelin libraries.

Fix

Continue to rely on well-audited and maintained external libraries. Ensure that any future custom logic introduced into similar contracts undergoes thorough security review.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The UnitasOFT contract is an Omnichain Fungible Token (OFT) built on LayerZero v2, inheriting from LayerZero's OFT and OpenZeppelin's Ownable contracts. It serves as a standard ERC-20 token with cross-chain capabilities. The contract itself contains minimal custom logic, primarily acting as a wrapper for the underlying LayerZero OFT implementation. The primary risks identified are related to the inherent centralization of control by the owner multisig over LayerZero configurations and the reliance on the security and operational integrity of the LayerZero protocol.

Technical8/10Low risk

The contract UnitasOFT is well-structured, inheriting from battle-tested OpenZeppelin Ownable and LayerZero OFT libraries (7.1 Architecture). It introduces no custom complex logic, reducing the surface area for new technical vulnerabilities (7.2 Code Security). The use of standard libraries mitigates common issues like reentrancy and integer overflows. However, the inherent complexity of cross-chain messaging via LayerZero introduces dependencies on external components like relayers and oracles, which are outside the direct control of this contract and represent a technical risk (7.6 External).

Governance2/10High risk

The contract utilizes an Ownable pattern, with a 3/5 multisig () acting as the owner (7.3 Access Control). This multisig holds significant administrative power, including the ability to configure LayerZero parameters such as peers, message versions, and potentially fees, which directly impacts the economic flow and security of cross-chain transfers (7.4 Economic). While a multisig reduces single points of failure, the concentration of control remains a notable governance risk (7.5 Governance). Misconfiguration by the owner could lead to funds being stuck or lost.

Upgrades7/10Low risk

The UnitasOFT contract is not designed as an upgradeable proxy (7.7 Upgrades). This eliminates risks associated with proxy implementation bugs or upgrade path vulnerabilities. However, it means that any future changes or bug fixes would require a new contract deployment and a token migration process, which can be complex and costly.

Final RecommendationWhat to do about this score

It is recommended to thoroughly review and secure the operational procedures for the owner multisig, ensuring robust key management and a transparent decision-making process for all LayerZero configurations.

Implement comprehensive monitoring for LayerZero endpoint and relayer activity to detect anomalies. Additionally, consider establishing an emergency response plan for potential LayerZero protocol-level issues or misconfigurations.

Contract & Record

1 audit on record
TypeSolidity 0.8.22
NetworkBNB Chain
Token age5mo
Contract0x0000…0000
Deployer0x0c54…0b36
Badge for your website
Unitas security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202659Medium
  2. Aug 11, 202652Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the UP contract address?

The Unitas (UP) contract on BNB Chain is 0x000008d2175f9aeaddb2430c26f8a6f73c5a0000. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Unitas a scam?

Quantum Audit's risk score for Unitas is 59/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is UP liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $1.33M.

Who holds UP?

As of Sep 4, 2026, the 10 largest holders own 98.0% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
Slap CatSLAP · BNB Chain59MediumniulaiBNB Chain59MediumRICE AIRICE · BNB Chain59MediumPrometeusPROM · BNB Chain59MediumDAPPOSDOS · BNB Chain59MediumDeAgentAIAIA · BNB Chain59Medium

Would You Like a More Detailed Audit of Unitas?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page