Audit Report
Paladin reviewed Hexagon Finance (Audit Report) on 29 Apr 2022: 55 findings, 0 critical; 39 marked fixed, 9 acknowledged, 7 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings55
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 1 | 5 |
| Medium | 0 | 2 | 5 |
| Low | 6 | 6 | 29 |
HighcancelLeave transfers from msg.sender to msg.senderFixed
The report gives no description here.
Highdeposit and boostDeposit do not support fee-on-transfer tokensFixed
The report gives no description here.
HighGovernance Privilege: setFlake can be set again and prevent users from depositing or withdrawing from the contractFixed
The report gives no description here.
HighGovernance Privilege: setMulsigAndFarmChef can be used to change the farmChef address to an EOA or a malicious contract which could cause the theft of users their boostedTokensFixed
The report gives no description here.
HighThe pending variable is perpetually boosted and rewards excessive rewardTokenFixed
The report gives no description here.
MediumgetLeaveApplyHistory does not work as intendedFixed
The report gives no description here.
MediumGovernance Privilege: setLeavingTerm can be set to an arbitrarily high value by the governanceFixed
The report gives no description here.
MediumminBoostAmount can only be 0 or 500 etherFixed
The report gives no description here.
MediumThe rewarder is called with a zero oldAmount on emergencyWithdrawFixed
The report gives no description here.
MediumUnsafe casts are made throughout the contract that can cause issuesFixed
The report gives no description here.
Show 10 more
Low_amount and _share should be required to be greater than zero in the various external functionsFixed
The report gives no description here.
Lowenter function does not support fee-on-transfer tokensFixed
The report gives no description here.
LowgetTeamRatio, getTotalBoostedAmount, boostStakedFor and boostTotalStaked can be made externalFixed
The report gives no description here.
LowGovernance Privilege: Owner can burn other users’ tokensFixed
The report gives no description here.
LowInconsistent usage of SafeMath functionsFixed
The report gives no description here.
LowInconsistent usage of SafeMath functionsFixed
The report gives no description here.
LowInconsistent usage of uint256Fixed
The report gives no description here.
LowLack of events for function setFlake, setLeavingTerm, setMulsigFixed
The report gives no description here.
LowLack of events on privileged functionsFixed
The report gives no description here.
LowLack of safeTransfer usage within enter and leaveFixed
The report gives no description here.
Show 10 more
Lowmint function can be used to pre-mint large amounts of tokens before ownership is transferred to MiniChefV2Fixed
The report gives no description here.
Lowname, symbol and decimals can be made externalFixed
The report gives no description here.
Lowpid can be made immutableFixed
The report gives no description here.
LowSeveral functions can be made externalFixed
The report gives no description here.
LowSeveral functions can be made externalFixed
The report gives no description here.
LowThe AddAuthorization and RemoveAuthorization events are unusedFixed
The report gives no description here.
LowThe Enter, Leave, ApplyLeave, and CancelLeave events are indexing amounts which are unnecessaryFixed
The report gives no description here.
LowThe first user could steal the tokens deposited by the next users by manipulating the share valueFixed
The report gives no description here.
LowThe pending reward function will revert if totalAllocPoint is zeroFixed
The report gives no description here.
LowThe searchPendingIndex function might not pick the last index if that value occurs multiple timesFixed
The report gives no description here.
Show 9 more
LowToken amounts can be made more readable by separating the digits into thousandsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowUnnecessary casting of tokenDecimal to uint8Fixed
The report gives no description here.
LowUnnecessary typing of tokenDecimal to uint256 while casting it to uint8Fixed
The report gives no description here.
LowUnused import: SmallNumbers.solFixed
The report gives no description here.
LowUnused importsFixed
The report gives no description here.
LowUnused imports and approvalFixed
The report gives no description here.
LowUnused variables: noncesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Hexagon Finance’s security record
Hexagon FinanceSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us