HToken

Ethereum

Audited on 2026/06/10

No open critical findings

Summary

`HToken` is an upgradeable ERC-20 token based on OpenZeppelin 5.1.0. It has been [deployed](https://etherscan.io/tx/0xcf8b922e2ab4a5762fb5aec79dc977a8ffd61dd2a701f7edf0785c96b1d677e9) to Ethereum mainnet. We note one informational-severity finding as an outcome of the audit: although the runbook for the protocol prohibits renouncing ownership of the token, the function itself is not overridden. The test suite is strong for a repository of this size. It tests the token through the real Ignition proxy deployment path, checks EIP-1967 admin/implementation behavior, initialization locking, owner-only mint/burn, ownership transfer, and upgrade execution through ProxyAdmin. Documentation is good at the operator/runbook level. `docs/runbook.md` and `docs/upgrade.md` are practical: they explain deployment, verification, multisig cermonies, and upgrade operator sequence. As of 2026-06-10, 16:46 (UTC), the onchain details are as follows: Token - Address: `0xE76c5b78f93909d34404E9eb4C1f19e7582a5dE1` - Name: Humanity - Symbol: H - Type: EIP-1967 `TransparentUpgradeableProxy` - Implementation: `0x85D0B85f290ba575c50a6be38f24F9e99F94E7D3` (`HToken`) Proxy Admin - Address: `0xb3b355A9BFc10073055100d36a05269aB888ac90` - Type: OpenZeppelin `ProxyAdmin v5.0.0` Admin Owner → Gnosis Safe - Address: `0xa7b36650621b413a36cbae0ae0676e41f4519fdc` - Type: Safe (Gnosis Safe) with 4-of-7 threshold Signers (7): 1. `0x474f76B55D8CCB8CF9B3567bd5A68f1b25905052` 2. `0xC8AecdFEB45DE555A77E6294da7a16b50a24B49e` 3. `0xE935f57A837feD3dBC10B99227B21Ba90da1775D` 4. `0xFB21Fff1c50440ee7F1368Cb64941983940Ebb5E` 5. `0x74334140CD83445bbc413FE958C10A3869Df8714` 6. `0x46ae1aBcc09057c5AA7E659c6c7E523a6dc36827` 7.

Project