Incident
Incident,
The Hedgey Finance-related contract was drained of approximately 2 million USD.
Source: De.Fi incident database.
- Audits before it
- 1.
- Audits since
- 2, the latest dated 12 Nov 2024.
Hedgey security record
As of 30 Oct 2026, Hedgey has 3 audit reports by 2 security firms on Trustblock; the latest is by Resonance Security, dated 12 Nov 2024. Those reports list no open critical findings. It also holds 1 incident (latest 18 Apr 2024).
Critical findings
No open critical findings
Across 3 reports.
Incident
Incident 18 Apr 2024
Source: De.Fi incident database. 2 audits have been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Hedgey Finance | Security firm: Resonance Security | Date: | Scope: 94 addresses on 13 chains | No open critical findings | Open · IPFS |
| Hedgey Finance | Security firm: Resonance Security | Date: | Scope: 94 addresses on 13 chains | No open critical findings | Open · IPFS |
| Hedgey Token Lockup and Vesting Plans | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
Findings31
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 5 | 0 | 1 |
| Low | 16 | 0 | 9 |
MediumPossibility Of Combining The Same PlanHedgey Finance · Resonance Security · 20 Jun 2024Fixed
The function _combinePlans() allows users to combine segmented plans back into a single plan. This function essentially performs the reverse operations of the function _segmentPlan(), where several validations and calculations are made and bot plans are merged into the plan identified by planId0. After the merge occurs, the plan identified by planId1 is deleted.There is an edge-case within this function that allows both planId0 and planId1 to be the same id, due to the lack of the necessary validation. This may happen purposefully or by mistake. However, when this scenario occurs, since planId0 and planId1 are the same, the plan will be deleted and all locked tokens will be lost.
Open the reportLowMissing Zero Address Validation Of treasuryHedgey Finance · Resonance Security · 12 Nov 2024Fixed
The ClaimCampaigns() constructor and changeTreasury() functions do not validate _treasury or _newTreasury parameters, so callers can accidentally set important state variables to the zero address.This could lead to loss of fees.
Open the reportLowNon-external Function Names And Variables (Private Or Internal) Should Begin With An UnderscoreHedgey Finance · Resonance Security · 12 Nov 2024Fixed
According to the Solidity Style Guide, non-external functions and variable names should begin with an underscore.
Open the reportLowVariables Are Initialized With Default ValuesHedgey Finance · Resonance Security · 12 Nov 2024Fixed
Index in for-loops are initialized to 0, which is not necessary.
Open the reportLowArchitectural Pattern of Internal and External Functions Increases Attack SurfaceHedgey Token Lockup and Vesting Plans · Consensys · 1 Jun 2023Fixed
The report gives no description here.
Open the reportLowBalance of msg.sender Is Used Instead of the from AddressHedgey Token Lockup and Vesting Plans · Consensys · 1 Jun 2023Fixed
The report gives no description here.
Open the reportLowRevoking Vesting Will Trigger a Taxable EventHedgey Token Lockup and Vesting Plans · Consensys · 1 Jun 2023Fixed
The report gives no description here.
Open the reportLowUnused Code in Source Files ✓Hedgey Token Lockup and Vesting Plans · Consensys · 1 Jun 2023Fixed
The report gives no description here.
Open the reportLowUse of selfdestruct Deprecated in VotingVaultHedgey Token Lockup and Vesting Plans · Consensys · 1 Jun 2023Fixed
The report gives no description here.
Open the reportLowVesting Admin Could Prevent the Recipient From RedeemingHedgey Token Lockup and Vesting Plans · Consensys · 1 Jun 2023Fixed
The report gives no description here.
Open the reportIncidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="hedgey-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us