HeyElsa (OFT bridge) security record
As of 11 Nov 2026, HeyElsa (OFT bridge) has 8 audit reports by 2 security firms on Trustblock; the latest is by QuillAudits, dated 1 May 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits8
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| HeyElsa Staking V2 | Security firm: QuillAudits | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa - Staking Contract V2 | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa Airdrop Smart Contract | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa Staking Contract | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa (OFT bridge) | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa V2 | Security firm: QuillAudits | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa Token Contract | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa - Token Contract | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
Findings55
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 7 |
| Medium | 0 | 1 | 11 |
| Low | 0 | 0 | 14 |
HighAsymmetric eligibility-window guard inflates the eligible-ve denominator and permanently dilutes honest staker's rewardsHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportHigh_snapshotEligibleSupply() Backdates Mid-Week Deposits to the Epoch StartHeyElsa - Staking Contract V2 · CredShields · 17 Apr 2026Fixed
The report gives no description here.
Open the reportHigheligibleVeAtT Returns Zero for Historical Queries - Permanent Reward DestructionHeyElsa - Staking Contract V2 · CredShields · 17 Apr 2026Fixed
The report gives no description here.
Open the reportHighReward Theft via Withdraw-Relock - Global ve Numerator vs Eligible-Only DenominatorHeyElsa - Staking Contract V2 · CredShields · 17 Apr 2026Fixed
The report gives no description here.
Open the reportHighEmergency Withdraw Can Forfeit User RewardsHeyElsa Staking Contract · CredShields · 8 Jan 2026Fixed
The report gives no description here.
Open the reportHighReward loss due to updating rewardDebt during insolvencyHeyElsa Staking Contract · CredShields · 8 Jan 2026Fixed
The report gives no description here.
Open the reportHighFrontrunnable Stake Index Reordering Can Cause Unintended Early-Unstake PenaltiesHeyElsa V2 · QuillAudits · 1 Jan 2026Fixed
The report gives no description here.
Open the reportMediumReward Dust Locked Due to Integer DivisionHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportMediumdepositFor Missing Blacklist Validation Allows Deposits to Restricted AddressesHeyElsa - Staking Contract V2 · CredShields · 17 Apr 2026Fixed
The report gives no description here.
Open the reportMediumInconsistent lastPoint.blk Assignment in _checkpointEligible vs _fillPointHistoryHeyElsa - Staking Contract V2 · CredShields · 17 Apr 2026Fixed
The report gives no description here.
Open the reportShow 10 more
Mediumtx.origin Validation in onlyUserOrWhitelist Will Break Under EIP-7702HeyElsa - Staking Contract V2 · CredShields · 17 Apr 2026Fixed
The report gives no description here.
Open the reportMediumAdmin Can Alter Rewards For Existing StakersHeyElsa Staking Contract · CredShields · 8 Jan 2026Fixed
The report gives no description here.
Open the reportMediumPermit Front-Running Griefing in stakeWithPermit Can Cause Transaction RevertsHeyElsa Staking Contract · CredShields · 8 Jan 2026Fixed
The report gives no description here.
Open the reportMediumUser Can Permanently Block Own Account InteractionsHeyElsa Staking Contract · CredShields · 8 Jan 2026Fixed
The report gives no description here.
Open the reportMediumGasless Staking Authorization Is Frontrunnable, Allowing Tier ManipulationHeyElsa V2 · QuillAudits · 1 Jan 2026Fixed
The report gives no description here.
Open the reportMediumIncorrect STAKE_AUTHORIZATION_TYPEHASH Breaks Gasless Staking AuthorizationHeyElsa V2 · QuillAudits · 1 Jan 2026Fixed
The report gives no description here.
Open the reportMediumLack of Partial Reward Claims Can Permanently Lock User RewardsHeyElsa V2 · QuillAudits · 1 Jan 2026Fixed
The report gives no description here.
Open the reportMediumTime-Based Reward Accrual Is Not Bounded by Reward Pool, Leading to Severe Reward InsolencyHeyElsa V2 · QuillAudits · 1 Jan 2026Fixed
The report gives no description here.
Open the reportLow_withdraw Silent No-Op When No Lock Exists Obscures Caller ErrorsHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportLowNo Rescue Function for Accidentally Sent ERC-20 or ETH TokensHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowRewardsClaimed Event Emits Input toEpoch Instead of Actual Last-Processed EpochHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportLowrewardsMax Cap Not Applied in Reward View Functions, Overstating Available RewardsHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportLowclaimFor Allows Unsolicited Reward Claims Without User ConsentHeyElsa - Staking Contract V2 · CredShields · 17 Apr 2026Fixed
The report gives no description here.
Open the reportLowclaimPartial Allows Self-Inflicted Permanent Epoch SkippingHeyElsa - Staking Contract V2 · CredShields · 17 Apr 2026Fixed
The report gives no description here.
Open the reportLowfreezeEligibilityEnd Has No On-Chain Ordering Enforcement with RewardDistributor InitializationHeyElsa - Staking Contract V2 · CredShields · 17 Apr 2026Fixed
The report gives no description here.
Open the reportLowMissing events in important functionsHeyElsa - Staking Contract V2 · CredShields · 17 Apr 2026Fixed
The report gives no description here.
Open the reportLowNo MINTIME Validation in ConstructorHeyElsa - Staking Contract V2 · CredShields · 17 Apr 2026Fixed
The report gives no description here.
Open the reportLowFloating and Outdated PragmaHeyElsa Airdrop Smart Contract · CredShields · 14 Jan 2026Fixed
The report gives no description here.
Open the reportLowOutdated PragmaHeyElsa Staking Contract · CredShields · 8 Jan 2026Fixed
The report gives no description here.
Open the reportLowReactivating a Previously Deactivated Tier Does Not Reinsert It into activeTierIds ArrayHeyElsa Staking Contract · CredShields · 8 Jan 2026Fixed
The report gives no description here.
Open the reportShow 2 more
LowOutdated PragmaHeyElsa Token Contract · CredShields · 31 Dec 2025Fixed
The report gives no description here.
Open the reportLowFloating and Outdated PragmaHeyElsa - Token Contract · CredShields · 20 Nov 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="heyelsa-oft-bridge"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us