On-chain security analysis — is it a scam or legit?
The OptimismMintableERC20 contract serves as a cross-chain token, combining Optimism's mintable token standard with LayerZero's Omnichain Fungible Token (OFT) functionality.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The 20 remaining pairs hold $401.7K between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xf1c4…71c80xfbc9…a3610x0ff1…7d770x2744…01ca0x3624…147c0xeff4…d00f0xda21…e12f0x46d8…b5b50x06c5…d2b40xceb9…3d6dNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
OptimismMintableERC20 contract becomes the owner of the inherited OAppCore component and is also set as the delegate for the LayerZero endpoint. This grants significant control over the contract's cross-chain functionality, including the ability to call setPeer (to configure trusted remote OApp instances) and potentially other LayerZero endpoint configurations via the delegate role. A compromise of this single owner/delegate key could lead to misrouting of cross-chain token transfers, denial of service, or other manipulations of the OFT functionality (7.3 Access Control, 7.6 External).H-01The deployer of the OptimismMintableERC20 contract becomes the owner of the inherited OAppCore component and is also set as the delegate for the LayerZero endpoint. This grants significant control over the contract's cross-chain functionality, including the ability to call setPeer (to configure trusted remote OApp instances) and potentially other LayerZero endpoint configurations via the delegate role. A compromise of this single owner/delegate key could lead to misrouting of cross-chain token transfers, denial of service, or other manipulations of the OFT functionality (7.3 Access Control, 7.6 External).
Transfer the ownership of the OAppCore component and the LayerZero delegate role to a robust multi-signature wallet or a DAO. This decentralizes control and significantly reduces the risk associated with a single point of failure.
Unresolved
BRIDGE address, which is critical for the mint and burn functions, is declared as immutable and set only during construction. While this prevents unauthorized modification post-deployment, it introduces operational rigidity. If the underlying bridge contract needs to be upgraded, replaced, or if a vulnerability is discovered in the designated bridge, this OptimismMintableERC20 contract would need to be redeployed, potentially requiring a costly and complex token migration process (7.1 Architecture, 7.8 Operations).M-01The BRIDGE address, which is critical for the mint and burn functions, is declared as immutable and set only during construction. While this prevents unauthorized modification post-deployment, it introduces operational rigidity. If the underlying bridge contract needs to be upgraded, replaced, or if a vulnerability is discovered in the designated bridge, this OptimismMintableERC20 contract would need to be redeployed, potentially requiring a costly and complex token migration process (7.1 Architecture, 7.8 Operations).
Acknowledge the implications of the immutable BRIDGE address. For future deployments, consider if a mutable bridge address (managed by a robust governance mechanism) is preferable, or ensure a clear migration strategy is in place for potential bridge upgrades. For the current deployment, ensure the BRIDGE address is thoroughly vetted and secure.
Unresolved
OAppCore component, which manages LayerZero configurations, is Ownable. The current setup assigns ownership to the contract deployer and does not include a mechanism or explicit recommendation to transfer this ownership to a more secure entity (e.g., a multi-signature wallet or DAO) or to renounce it if no further configuration changes are anticipated. While the deployer's address is initially the owner, relying on a single externally owned account (EOA) for such critical configuration control introduces a single point of failure risk (7.3 Access Control, 7.5 Governance).L-01The OAppCore component, which manages LayerZero configurations, is Ownable. The current setup assigns ownership to the contract deployer and does not include a mechanism or explicit recommendation to transfer this ownership to a more secure entity (e.g., a multi-signature wallet or DAO) or to renounce it if no further configuration changes are anticipated. While the deployer's address is initially the owner, relying on a single externally owned account (EOA) for such critical configuration control introduces a single point of failure risk (7.3 Access Control, 7.5 Governance).
Implement a robust ownership management strategy. Transfer ownership of the OAppCore component to a multi-signature wallet or a DAO immediately after deployment. If no further setPeer or delegate changes are expected, consider renouncing ownership to the zero address, though this would prevent any future configuration adjustments.
Unresolved
BRIDGE contract, whose address is set immutably in the constructor. Any vulnerability, exploit, or malicious action within the designated BRIDGE contract would directly impact the integrity and supply of this OptimismMintableERC20 token (7.6 External).I-01The core functionality of minting and burning tokens is entirely dependent on the security and correct functioning of the BRIDGE contract, whose address is set immutably in the constructor. Any vulnerability, exploit, or malicious action within the designated BRIDGE contract would directly impact the integrity and supply of this OptimismMintableERC20 token (7.6 External).
Ensure that the BRIDGE contract is thoroughly audited, regularly monitored, and maintained to the highest security standards. Users should be aware that the security of this token is intrinsically linked to the security of the external bridge.
Unresolved
The OptimismMintableERC20 contract serves as a cross-chain token, combining Optimism's mintable token standard with LayerZero's Omnichain Fungible Token (OFT) functionality. The audit identified a high-severity access control issue related to the centralized management of LayerZero configurations, alongside medium and low-severity findings concerning operational rigidity and ownership best practices.
The contract leverages well-audited OpenZeppelin and LayerZero libraries, providing a robust foundation for ERC20 and cross-chain functionality. The mint and burn functions are appropriately restricted to the immutable BRIDGE address, enhancing core token supply security (7.3 Access Control, 7.2 Code Security). However, a significant concern arises from the centralized control over LayerZero's setPeer function and the delegate role, which could allow a compromised owner to manipulate cross-chain message routing (7.3 Access Control, 7.6 External).
The economic model relies on the integrity of the BRIDGE contract for token supply management, which is an inherent design dependency (7.4 Economic). The BRIDGE address is immutable, preventing unauthorized changes but introducing rigidity; any future bridge upgrades would necessitate redeployment of this token contract (7.1 Architecture). Furthermore, the deployer's control over LayerZero's setPeer and delegate roles presents a centralized governance risk for cross-chain operations (7.5 Governance).
The contract is not designed with an upgradeability pattern (e.g., proxy), meaning its logic cannot be modified post-deployment. While this eliminates upgrade-specific risks like proxy misconfigurations or logic bugs during upgrades (7.7 Upgrades), it also means that any future changes, bug fixes, or necessary updates to the OptimismMintableERC20 or its BRIDGE dependency would require a complete redeployment and migration of token holders, incurring significant operational overhead (7.8 Operations).
It is strongly recommended to transfer the ownership of the OAppCore component and the LayerZero delegate role to a robust multi-signature wallet or a decentralized autonomous organization (DAO) to mitigate the single point of failure identified in the LayerZero configuration.
Additionally, consider implementing a clear operational plan for potential future bridge upgrades, acknowledging the immutability of the BRIDGE address and the implications for token migration. Regular security reviews of the external BRIDGE contract are also advised due to the direct dependency on its security.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Virtual Protocol (VIRTUAL) contract on Base is 0x0b3e328455c4059eeb9e3f84b5543f74e24e7e1b. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Virtual Protocol is 35/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Renounced; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $9.32M.
As of Sep 4, 2026, the 10 largest holders own 46.7% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
