Hashflow-Audit3

CertiKFiles named in the report

CertiK reviewed Hashflow (Hashflow-Audit3) on 19 Sep 2022: 9 findings, 0 critical; 6 marked fixed, 1 acknowledged, 2 open.

No open critical findings
Open the reportOpen Hashflow’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High010
Medium000
Low206
HighCentralization Related RisksAcknowledged

In the contract `HashflowFactory` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set contract addresses used to create a new pool. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cf9ca95175de4be1ae904f14f30f77c1/diagrams/centralization_HashflowFactory-HashflowFactory-_owner.svg) In the contract `HashflowGovernance` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and modify critical parameters of the Hashflow protocol. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cf9ca95175de4be1ae904f14f30f77c1/diagrams/centralization_HashflowGovernance-HashflowGovernance-_owner.svg) In the contract `HashflowRouter` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and withdraw funds from the router. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cf9ca95175de4be1ae904f14f30f77c1/diagrams/centralization_HashflowRouter-HashflowRouter-_owner.svg) Furthermore, the role `factory` has authority over the functions shown in the diagram below. Any compromise to the `factory` account may allow the hacker to take advantage of this authority and add/remove authorized pools. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cf9ca95175de4be1ae904f14f30f77c1/diagrams/centralization_HashflowRouter-HashflowRouter-factory.svg) In the contract `HashflowPool` the role `_operations` has authority over the functions shown in the diagram below. Any compromise to the `_operations` account may allow the hacker to take advantage of this authority and update pool properties and drain the funds. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cf9ca95175de4be1ae904f14f30f77c1/diagrams/centralization_HashflowPool-HashflowPool-_operations.svg) In the contract `HashflowPrivatePool` the role `_authorizedRouter` has authority over the functions shown in the diagram below. Any compromise to the `_authorizedRouter` account may allow the hacker to take advantage of this authority. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cf9ca95175de4be1ae904f14f30f77c1/diagrams/centralization_HashflowPrivatePool-HashflowPrivatePool-_authorizedRouter.svg) Furthermore, the role `_operations` has authority over the functions shown in the diagram below. Any compromise to the `_operations` account may allow the hacker to take advantage of this authority and remove pool liquidity. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cf9ca95175de4be1ae904f14f30f77c1/diagrams/centralization_HashflowPrivatePool-HashflowPrivatePool-_operations.svg) Additionally, the role `_xChainUa` has authority over the functions shown in the diagram below. Any compromise to the `_xChainUa` account may allow the hacker to take advantage of this authority and withdraw funds from the pool. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cf9ca95175de4be1ae904f14f30f77c1/diagrams/centralization_HashflowPrivatePool-HashflowPrivatePool-_xChainUa.svg) In the contract `HashflowPublicPool` the role `_authorizedRouter` has authority over the functions shown in the diagram below. Any compromise to the `_authorizedRouter` account may allow the hacker to take advantage of this authority and remove pool liquidity. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cf9ca95175de4be1ae904f14f30f77c1/diagrams/centralization_HashflowPublicPool-HashflowPublicPool-_authorizedRouter.svg) Furthermore, the role `_operations` has authority over the functions shown in the diagram below. Any compromise to the `_operations` account may allow the hacker to take advantage of this authority and withdraw funds from the pool. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cf9ca95175de4be1ae904f14f30f77c1/diagrams/centralization_HashflowPublicPool-HashflowPublicPool-_operations.svg) Additionally, the role `_xChainUa` has authority over the functions shown in the diagram below. Any compromise to the `_xChainUa` account may allow the hacker to take advantage of this authority and withdraw funds from the pool. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cf9ca95175de4be1ae904f14f30f77c1/diagrams/centralization_HashflowPublicPool-HashflowPublicPool-_xChainUa.svg) Finally, regarding the contract `HashflowPublicPool`, the role `_withrawalAccountAuth` has authority over the function `transferAssets()`. Any compromise to the `_withrawalAccountAuth` account may allow the hacker to take advantage of this authority and withdraw funds from the pool. In the contract `HashflowXChainUA` the role `_lzEndpoint` has authority over the functions shown in the diagram below. Any compromise to the `_lzEndpoint` account may allow the hacker to take advantage of this authority and withdr

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (8)

  • contracts/HashflowRouter.sol
  • contracts/HashflowFactory.sol
  • contracts/core/HashflowERC20.sol
  • contracts/HashflowGovernance.sol
  • contracts/pools/HashflowPrivatePool.sol
  • contracts/pools/HashflowPublicPool.sol
  • contracts/pools/HashflowPool.sol
  • contracts/xchain/HashflowXChainUA.sol

Part of Hashflow’s security record

Hashflow
Audits4 audits by 3 firmsLast audit Mar 2023, by Quantstamp.
Critical findingsNo open critical findingsAcross 4 reports.
IncidentIncident 13 Jun 2023Source: De.Fi incident database.
Open Hashflow’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us