Hyperbeat security review
Audit · firm’s term: security review
Pashov Audit Group reviewed Hyperbeat (Hyperbeat security review) on 5 Sep 2025: 17 findings, 0 critical; all acknowledged, none fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings17
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 2 | 0 |
| Low | 0 | 15 | 0 |
MediumgetTotalProtocolHype() includes pending withdrawal amountsAcknowledged
The report gives no description here.
MediumIdle HYPE balance consideration allows silent bypass of exchange rate guardAcknowledged
The report gives no description here.
Low_convertToBucketUnit() uses < instead of <= to check for overflowAcknowledged
The report gives no description here.
LowBeHYPE and WithdrawManager contracts incorrectly import IBeHYPE.solAcknowledged
The report gives no description here.
LowdepositToHyperCore() fails to account for hypeRequestedForWithdrawAcknowledged
The report gives no description here.
LowemergencyWithdrawFromStaking() does not update lastWithdrawalTimestampAcknowledged
The report gives no description here.
LowEvent spamming because stake() does not enforce a minimum amountAcknowledged
The report gives no description here.
LowFirst staker uses wrong exchangeRatio if totalSupply() of beHYPE is 0Acknowledged
The report gives no description here.
LowFunds not transferred before withdrawManager updateAcknowledged
The report gives no description here.
LowLoss events may be blocked from updating exchange ratio due to APR guardAcknowledged
The report gives no description here.
Show 7 more
LowPending withdrawals are not considered in total Hype assetsAcknowledged
The report gives no description here.
LowPrecision loss in updateExchangeRatio()Acknowledged
The report gives no description here.
LowRounding down in fee calculation causes protocol revenue loss over timeAcknowledged
The report gives no description here.
LowRounding in stake() is in favour of usersAcknowledged
The report gives no description here.
LowStakingCore does not account for pending deposits to Hyper CoreAcknowledged
The report gives no description here.
LowTreasury receives staking rewards due to fees being taken in form of beHYPEAcknowledged
The report gives no description here.
LowWithdraw from staking limit can be bypassed via multiple callsAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Hyperbeat’s security record
HyperbeatSecurity firm
Pashov Audit Group86 projects reviewed · 165 reports · latest Aug 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us