On-chain security analysis — is it a scam or legit?
The ZyfaiOFT contract is an Omnichain Fungible Token (OFT) implementation using LayerZero standards.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 28, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xdb60…f7d70xd82f…e9620xd860…84800x55b8…cde6The functions send, lzReceiveSimulate, and lzReceive allow for the minting of new tokens as part of the cross-chain transfer process. This increases the total supply of the token, which can lead to the dilution of existing holders if the cross-chain bridge is compromised or if minting parameters are misconfigured.
Monitor the total supply and cross-chain activity closely. Ensure that the LayerZero endpoint and peer configurations are strictly managed by the multisig and that any changes to enforced options are thoroughly tested on a testnet before deployment.
Unresolved
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 3 address(es) other than the owner/deployer. One of them — a contract, 0xdb60…f7d7 — holds 99.6% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The ten largest holders own 67.1% of supply. Of that, 10.5% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 3.7% in wallets, 52.8% in other contracts. 4,278 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Zyfai (ZFI), market cap $2M, rank #2390. 4,278 holders.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $264K (DexScreener, all pools). 24h trading volume $9K (CoinGecko, all markets, daily snapshot). 24h trading volume $53K (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token representing another asset's units 1:1, backed by a wrapping contract, a custodian or a bridge. The class itself adds no points; the contract and market facts decide the score. Basis: a copy of the coin from its home chain (zksync), minted here by LayerZero (lzReceive). Tokenomics — Supply: minted here by LayerZero (lzReceive) against tokens locked or burned on other chains. Control: a 3-of-5 multisig. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $264K of DEX liquidity across 6 pools. Launch: 509 days of market history.
The backing is the risk: check who holds the underlying asset and how redemption works.
Acknowledged
The ZyfaiOFT contract is an Omnichain Fungible Token (OFT) implementation using LayerZero standards. The architecture is robust, leveraging established libraries for cross-chain messaging. The primary risk involves the minting capability inherent in the OFT standard, which allows for supply expansion during cross-chain transfers.
The contract utilizes standard LayerZero OFT libraries, ensuring 7.1 Architecture and 7.2 Code Security compliance. 7.3 Access Control is correctly implemented using Ownable for administrative functions. 7.6 External interactions are limited to the LayerZero endpoint, which is a trusted dependency. The code is clean and follows modern Solidity patterns.
7.4 Economic and 7.5 Governance risks are centered on the minting mechanism. While necessary for cross-chain functionality, the ability to mint tokens via lzReceive introduces potential dilution risks. The protocol relies on a 3-of-5 multisig for administrative control, providing a reasonable balance between security and operational agility.
The contract is not upgradeable (7.7 Upgrades), which eliminates risks associated with proxy logic flaws. 7.8 Operations are managed via standard ownership patterns. No further upgradeability concerns exist.
The protocol is well-structured. We recommend maintaining the multisig threshold and ensuring that the LayerZero endpoint configuration remains audited and monitored for any updates to the underlying messaging protocol.
Users should be aware that the total supply of the token is dynamic due to the OFT cross-chain minting mechanism. Ensure that the multisig signers are geographically and organizationally distributed to mitigate single-point-of-failure risks.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The ZyFAI (ZFI) contract on Base is 0xd080ed3c74a20250a2c9821885203034acd2d5ae. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for ZyFAI is 46/100 (Medium risk) as of Oct 28, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Oct 28, 2026). Total DEX liquidity: $264.2K.
As of Oct 28, 2026, the 10 largest holders own 67.1% of the supply across 4,278 holders. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
