Case Study: BSC Cross-Chain OFT Token Audit — Broken Bridge Logic and Uncapped Mint Authority

What We Found

When this token is minted or transferred through the LayerZero bridge, the contract is supposed to check and update the balance of the actual token holder. Instead, it mistakenly checks the bridge contract's own address every time. This means whitelist rules apply to the wrong party, minting records are attributed incorrectly, and the contract silently records bad state — all without throwing an error. Cross-chain transfers appear to succeed while the contract is quietly broken underneath.

Why It Matters

Cross-chain minting and whitelist enforcement operate on the wrong address, corrupting internal state without reverting. Any logic dependent on per-address accounting (whitelist, limits, caps) will produce incorrect results for bridge transactions.

What Should Be Done

Replace msg.sender with the from parameter in the _update hook so that state changes are correctly attributed to the actual token sender or recipient, not the calling bridge contract.

What We Found

The contract tracks a total token supply across all chains in a single number to prevent unlimited issuance. However, when tokens move across chains through the bridge, this total is never adjusted. This means anyone can move tokens back and forth through the bridge repeatedly to exceed the intended cap without triggering any limit check.

Why It Matters

The cross-chain supply cap can be bypassed through normal bridge activity, enabling issuance of tokens well beyond the intended maximum and devaluing all existing holders.

What Should Be Done

Update supplyAllChains on every bridge mint and burn operation to keep the cross-chain total accurate and enforced.

What We Found

The contract owner can add any wallet address to a list of approved minters at any time, with no delay and no second approval required. Each minter can then create new tokens without any per-minter cap. If the owner's account is ever compromised — or acts maliciously — they can quietly grant minting power to attacker-controlled wallets, and unlimited token creation can begin immediately.

Why It Matters

A compromised or malicious owner can instantly grant unlimited minting authority to any address, enabling inflation attacks that dilute and devalue every existing token holder.

What Should Be Done

Introduce a timelock on minter additions, require a multisig or at minimum a two-step confirmation, and enforce per-minter issuance caps.

What We Found

The LayerZero OFT bridge works by burning tokens on the source chain and minting them on the destination chain. During the pre-launch period, this contract blocks all burns with no exceptions. This means every cross-chain send initiated during pre-launch will fail — even for whitelisted users — because the required burn step is forbidden. Users would lose gas and receive no tokens on the destination chain.

Why It Matters

All cross-chain bridge sends fail during the pre-launch period for every user, including those explicitly whitelisted. Gas is consumed without any token movement occurring.

What Should Be Done

Exempt the OFT bridge contract address from the burn restriction during pre-launch, or add a dedicated flag that allows bridge-initiated burns while still blocking direct user burns.