CertiK reviewed Hashflow (Hashflow-Audit3) on 19 Sep 2022: 9 findings, 0 critical; 6 marked fixed, 1 acknowledged, 2 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 2 | 0 | 6 |
In the contract `HashflowFactory` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set contract addresses used to create a new pool.  In the contract `HashflowGovernance` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and modify critical parameters of the Hashflow protocol.  In the contract `HashflowRouter` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and withdraw funds from the router.  Furthermore, the role `factory` has authority over the functions shown in the diagram below. Any compromise to the `factory` account may allow the hacker to take advantage of this authority and add/remove authorized pools.  In the contract `HashflowPool` the role `_operations` has authority over the functions shown in the diagram below. Any compromise to the `_operations` account may allow the hacker to take advantage of this authority and update pool properties and drain the funds.  In the contract `HashflowPrivatePool` the role `_authorizedRouter` has authority over the functions shown in the diagram below. Any compromise to the `_authorizedRouter` account may allow the hacker to take advantage of this authority.  Furthermore, the role `_operations` has authority over the functions shown in the diagram below. Any compromise to the `_operations` account may allow the hacker to take advantage of this authority and remove pool liquidity.  Additionally, the role `_xChainUa` has authority over the functions shown in the diagram below. Any compromise to the `_xChainUa` account may allow the hacker to take advantage of this authority and withdraw funds from the pool.  In the contract `HashflowPublicPool` the role `_authorizedRouter` has authority over the functions shown in the diagram below. Any compromise to the `_authorizedRouter` account may allow the hacker to take advantage of this authority and remove pool liquidity.  Furthermore, the role `_operations` has authority over the functions shown in the diagram below. Any compromise to the `_operations` account may allow the hacker to take advantage of this authority and withdraw funds from the pool.  Additionally, the role `_xChainUa` has authority over the functions shown in the diagram below. Any compromise to the `_xChainUa` account may allow the hacker to take advantage of this authority and withdraw funds from the pool.  Finally, regarding the contract `HashflowPublicPool`, the role `_withrawalAccountAuth` has authority over the function `transferAssets()`. Any compromise to the `_withrawalAccountAuth` account may allow the hacker to take advantage of this authority and withdraw funds from the pool. In the contract `HashflowXChainUA` the role `_lzEndpoint` has authority over the functions shown in the diagram below. Any compromise to the `_lzEndpoint` account may allow the hacker to take advantage of this authority and withdr
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (8)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us