Hedgehog Protocol
ChainSecurity reviewed Hedgehog (Hedgehog Protocol) on 2 Jun 2025: 58 findings, 5 critical; all marked fixed.
Report hosted on chainsecurity.com.
Trustblock does not review code.
Findings58
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 5 |
| High | 0 | 0 | 11 |
| Medium | 0 | 0 | 23 |
| Low | 0 | 0 | 19 |
CriticalCollateral Surplus Is Stuck in the ContractFixed
The report gives no description here.
CriticalIncorrect Price Used for Collateralization RatioFixed
The report gives no description here.
CriticalRedeemed Amount Does Not Account for DecimalsFixed
The report gives no description here.
CriticalWrong Conversion Formula Used in _getCappedOffsetValsFixed
The report gives no description here.
CriticalWrong Decimals Returned by _computeCRFixed
The report gives no description here.
HighGas Compensation Is Ignored in Trove RedemptionFixed
The report gives no description here.
HighGas Compensation Is Not Accounted for Correctly When Closing a TroveFixed
The report gives no description here.
HighIncompatible Interface With BaseFeeOracleArbFixed
The report gives no description here.
HighLiquidations Are Blocked From Withdrawal LimitFixed
The report gives no description here.
HighPrice Feed Returns Wrong PriceFixed
The report gives no description here.
Show 10 more
HighPrice Feed Stores and Returns Wrong DecimalsFixed
The report gives no description here.
HighRedemption Fees Can Be Lowered to Floor ValueFixed
The report gives no description here.
HighRedemption Rate Double Counts the Redemption ShareFixed
The report gives no description here.
HighWithdrawal Limit Does Not Track CollateralFixed
The report gives no description here.
HighWithdrawing wstETH Gains to Trove RevertsFixed
The report gives no description here.
HighWrong Conversion Rate Used in HintHelpersFixed
The report gives no description here.
MediumAdversary Can Keep Withdrawal Limit TinyFixed
The report gives no description here.
MediumChange of Issuance Curve Has Unexpected Side EffectsFixed
The report gives no description here.
MediumChosen Values for Gas Compensation and Minimum Debt Are LowFixed
The report gives no description here.
MediumClosing a Trove Does Not Update the Withdrawal LimitFixed
The report gives no description here.
Show 10 more
MediumClosing Troves Requires Borrowers Having Larger Balance Than NeededFixed
The report gives no description here.
MediumDistribution Functions in FeesRouter Use Wrong ConfigsFixed
The report gives no description here.
MediumDouble Counting of Full Redemptions in Withdrawal Limit CalculationFixed
The report gives no description here.
MediumFunction _getUSDValue Computes Wrong ValueFixed
The report gives no description here.
MediumGas Compensation Not Accounted on Redemption HintsFixed
The report gives no description here.
MediumInconsistent Definition of Redemption ShareFixed
The report gives no description here.
MediumIncorrect CommunityIssuance Configuration Can Break the StabilityPoolFixed
The report gives no description here.
MediumIncorrect Timeout Value in PriceFeedArbFixed
The report gives no description here.
MediumLimit Can Exceed Active CollateralFixed
The report gives no description here.
MediumLiquidation Price Has Wrong DecimalsFixed
The report gives no description here.
Show 10 more
MediumLiquidations Update Withdrawal Limit in an Inconsistent WayFixed
The report gives no description here.
MediumLocking of Troves Is Longer Than SpecifiedFixed
The report gives no description here.
MediumMismatch of NICR Specifications With ImplementationFixed
The report gives no description here.
MediumPrice Feed Compares Timestamp to BlocknumberFixed
The report gives no description here.
MediumPriceFeed Does Not Check if Main Oracle RecoversFixed
The report gives no description here.
MediumRedemption Share Is Rounded to ZeroFixed
The report gives no description here.
MediumUnusual Decimals Used for Values in StabilityPoolFixed
The report gives no description here.
MediumWithdrawal Limit Reset on Collateral DepositsFixed
The report gives no description here.
MediumWrong Value Used to Calculate the Borrowing Rate With DecayFixed
The report gives no description here.
LowAdversary Can Slow the Recovery of Withdrawal LimitFixed
The report gives no description here.
Show 10 more
LowCollateralization Ratio Is Rounded DownFixed
The report gives no description here.
LowEvent BorrowBaseRateUpdated Is Emitted TwiceFixed
The report gives no description here.
LowExcess Fee Distribution in FeesRouterFixed
The report gives no description here.
LowFunction _findPriceBelowMCR Can Be ImprovedFixed
The report gives no description here.
LowImmutable Parameters Should Be ConstantsFixed
The report gives no description here.
LowIncomplete Error MessageFixed
The report gives no description here.
LowIncorrect Validation of RepaymentsFixed
The report gives no description here.
LowInitial Stake Rounds Down to ZeroFixed
The report gives no description here.
LowMagic Value for Expand DurationFixed
The report gives no description here.
LowMissing Event When Changing Withdrawal LimitFixed
The report gives no description here.
Show 8 more
LowMissing Event When Increasing BalanceFixed
The report gives no description here.
LowMissing Sanity ChecksFixed
The report gives no description here.
LowOutdated Specification for _handleWithdrawalLimitFixed
The report gives no description here.
LowPrecision Issue in Withdrawal Limit CalculationFixed
The report gives no description here.
LowUnclear Specification Regarding Oracle DecimalsFixed
The report gives no description here.
LowUnnecessary Limitation When Opening a TroveFixed
The report gives no description here.
LowWithdrawal Limit Function Has DiscontinuitiesFixed
The report gives no description here.
LowWithdrawal Threshold Can Be Circumvented by Splitting TransactionsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (32)
- CollSurplusPool.sol
- BaseFeeOracle.sol (replaced BaseFeeOracleArb.sol
- TroveManagerArb.sol (replaced TroveManager.sol
- TroveManagerArb.sol
- HedgehogBase.sol
- HintHelpers.sol
- TroveManager.sol (replaced TroveManagerArb.sol
- BorrowerOperationsArb.sol
- FeesRouter.sol
- PriceFeedArb.sol
- BorrowerOperationsArb.sol (replaced BorrowerOperations.sol
- BaseFeeOracleArb.sol
- PriceFeed.sol (replaced PriceFeedArb.sol
- HOGToken.sol
- StabilityPool.sol
- BaseFeeLMAToken.sol
- ActivePool.sol
- BorrowerOperations.sol
- DefaultPool.sol
- PriceFeedArb.sol (replaced PriceFeed.sol
- SortedTroves.sol
- TroveManager.sol
- GasPool.sol
- BaseMath.sol
- LiquitySafeMath128.sol
- CommunityIssuance.sol
- IERC2612.sol
- PriceFeed.sol
- LiquityMath.sol
- BaseFeeOracleArb.sol (replaced BaseFeeOracle.sol
- BaseFeeOracle.sol
- CheckContract.sol
Part of Hedgehog’s security record
HedgehogSecurity firm
ChainSecurity81 projects reviewed · 286 reports · latest Sep 2026
See ChainSecurity’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us