UNIVERSE (UNIVERSE) security report
Radar’s AI scan of UNIVERSE reviewed the verified LayerZero OFT source and supplied GoPlus evidence. No public mint, blacklist, tax, pause, or proxy upgrade path was identified, but owner-controlled peers can affect inbound mint authorization and an owner-set inspector can block cross-chain sends.
The token’s standard ERC-20 transfers are not restricted by blacklist, pause, or tax logic in the verified source. The main material risk is centralized LayerZero administration: the owner can replace trusted peers, affecting which remote application is authorized to trigger inbound minting, and can configure a message inspector that may block cross-chain sends.
Trust score: 68/100. Source verified: Yes. Chain: bsc. Contract: 0x6edda9096a4e6c9d310ad94456adc93725977243.
This report was last modified on 2026-10-10 and contains 3 material findings.
high finding: Owner can replace the trusted cross-chain peer that authorizes inbound minting
The owner can change the LayerZero peer for any endpoint. Inbound messages are accepted when the endpoint calls lzReceive and the origin sender equals the configured peer. The OFT receive path then calls _credit, which mints tokens to the encoded recipient. A compromised owner, malicious owner, or compromised authorized remote deployment could therefore alter the trusted cross-chain minting authority and affect token supply on this chain.
Evidence: OAppCore.setPeer(uint32,bytes32) is protected by onlyOwner and writes peers[eid]. OAppReceiver.lzReceive requires _getPeerOrRevert(_origin.srcEid) == _origin.sender. OFTCore._lzReceive decodes the recipient and calls _credit, while OFT._credit calls _mint(_to,_amountLD). GoPlus reports is_proxy=0 and owner_address=0xfff7381e72f0464875de8f0e5e17b12849642f6c, confirming that this is an owner-controlled non-proxy deployment rather than an upgradeable implementation.
Recommendation: Use a multisig or timelocked governance process for setPeer and document every authorized endpoint and remote peer. Monitor PeerSet events, validate remote deployments independently, and apply cross-chain supply caps or circuit breakers where the deployment architecture permits.
medium finding: Owner-controlled message inspector can block all cross-chain sends
The owner can set an arbitrary message-inspector contract. When configured, every OFT send invokes inspector.inspect(message, options). Any revert from that external call propagates through the transaction, allowing the configured inspector to deny cross-chain sends until it is replaced or disabled.
Evidence: OFTCore.setMsgInspector(address) is protected by onlyOwner and stores msgInspector. OFTCore._buildMsgAndOptions calls IOAppMsgInspector(inspector).inspect(message, options) whenever the address is nonzero. The call is not wrapped in error handling, so a reverting inspector causes send and quote-related execution paths using the builder to fail.
Recommendation: Restrict inspector changes through multisig or timelock governance, publish the inspector implementation and failure policy, and retain an operational procedure for setting the inspector to address(0) if it becomes unavailable or rejects valid messages.
medium finding: Owner can disable or redirect cross-chain routes through peer and messaging configuration
Cross-chain functionality depends on owner-managed LayerZero configuration. Removing a peer makes outbound sends revert because _getPeerOrRevert requires a nonzero peer, while changing peer or enforced options can redirect trust or make message execution operationally fail. This is a centralized availability and routing control, not an unrestricted ERC-20 transfer restriction.
Evidence: OAppCore.setPeer is onlyOwner and permits bytes32(0), which OAppCore._getPeerOrRevert rejects. OAppOptionsType3.setEnforcedOptions is also onlyOwner and its values are combined into outbound messaging options. The verified ABI exposes both functions.
Recommendation: Manage peer and enforced-option updates through delayed, observable governance. Publish the configured endpoint set and maintain monitoring for PeerSet and EnforcedOptionSet events so unexpected route or delivery changes can be detected quickly.