Hehe token

CertiK7 Dec 20231 address on Ethereum

Audit

CertiK reviewed HeHe (Hehe token) on 7 Dec 2023: 8 findings, 0 critical; 4 marked fixed, 3 acknowledged, 1 open.

No open critical findings

Open the report Open HeHe’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	1	0	1
Medium	0	0	0
Low	0	3	3

LowDiscussion on the `_nonce`Acknowledged

It is noted that nonce is not managed by current contract and its value is from the input, which may cause replay/reentrancy attack or other unexpected error.

LowRedundant Modifier "payable"Acknowledged

The payable function `retryMessage()` is designed to retry a message, however, the `payable` modifier should be applied to a function that **receives** the native token.

LowThird-Party Dependency UsageAcknowledged

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=20 ILayerZeroEndpoint public immutable lzEndpoint; ``` - The contract `LzApp` interacts with third party contract with `ILayerZeroEndpoint` interface via `lzEndpoint`.