Audit Report
Paladin reviewed Hextech (Audit Report) on 25 Jan 2022: 22 findings, 0 critical; 19 marked fixed, 2 acknowledged, 1 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings22
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 5 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 2 | 13 |
High_partialBurn should use from address instead of msg.sender to determine if burn should occurFixed
The report gives no description here.
HighBurner roles can arbitrarily burn tokens from any addressFixed
The report gives no description here.
HighBuyers can call claimRefund even if softCap is reached if stopICO is not called after the endICO block height passesFixed
The report gives no description here.
HighThe ICO can be started and stopped multiple timesFixed
The report gives no description here.
HighwithdrawErc20 allows the owner to withdraw all sale tokens in the contractFixed
The report gives no description here.
MediumBurn amount not subtracted from allowance used in transferFromFixed
The report gives no description here.
LowbuyTokens should not be payableFixed
The report gives no description here.
LowInconsistency between usage of _msgSender() and msg.senderFixed
The report gives no description here.
LowInconsistency between usage of _msgSender() and msg.senderFixed
The report gives no description here.
LowLack of events emitted in state changing functionsFixed
The report gives no description here.
Show 9 more
LowLack of maximum range check between startICOBlock and endICOFixed
The report gives no description here.
LowPublic functions can be made externalFixed
The report gives no description here.
LowThe difference between _availableTokens and availableTokensICO will not be available for sale and left in the contractFixed
The report gives no description here.
LowUnnecessary checking of WETH allowance in buyTokensFixed
The report gives no description here.
LowUnnecessary fallback functionFixed
The report gives no description here.
LowUnnecessary require statements in _preValidatePurchaseFixed
The report gives no description here.
LowUnnecessary setting of Claimed[beneficiary] to false in buyTokensFixed
The report gives no description here.
LowUnused uniswapV2Router state variableFixed
The report gives no description here.
LowWETH address is not publicFixed
The report gives no description here.
Contracts in scope3
| Address | Chain | Source code |
|---|---|---|
| 0xc423789ff617b8311317837a0af85c1f073ba38e | Chain: Polygon (POS) | Source code: Verified source |
| 0xd8b8d26bdd0fafcb0104c15f58fb4fb0ed467dd8 | Chain: Polygon (POS) | Source code: Verified source |
| 0xf467f169f3c2e2d0e0800b485651d176c540be81 | Chain: Polygon (POS) | Source code: Verified source |
Part of Hextech’s security record
Security firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us