HeyElsa (OFT bridge) security record
As of 11 Nov 2026, HeyElsa (OFT bridge) has 8 audit reports by 2 security firms on Trustblock; the latest is by QuillAudits, dated 1 May 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits8
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| HeyElsa Staking V2 | Security firm: QuillAudits | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa - Staking Contract V2 | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa Airdrop Smart Contract | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa Staking Contract | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa (OFT bridge) | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa V2 | Security firm: QuillAudits | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa Token Contract | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| HeyElsa - Token Contract | Security firm: CredShields | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
Findings55
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 7 |
| Medium | 0 | 1 | 11 |
| Low | 0 | 0 | 14 |
Marked Informational or Gas by the firms. Not counted as findings.
GasCheaper Inequalities in if()HeyElsa Staking Contract · CredShields · 8 Jan 2026Open
The report gives no description here.
Open the reportInformationalendSeason Blocked if Any Epoch in Range Not CheckpointedHeyElsa Staking V2 · QuillAudits · 1 May 2026Acknowledged
The report gives no description here.
Open the reportInformationalincreaseUnlockTime Emits No Event When Lock ExtendedHeyElsa Staking V2 · QuillAudits · 1 May 2026Acknowledged
The report gives no description here.
Open the reportInformationalMULTIPLIER and PRECISION Constants Use Non-Standard Naming ConventionHeyElsa Staking V2 · QuillAudits · 1 May 2026Acknowledged
The report gives no description here.
Open the reportInformationalAdmin Can Trigger Contract InsolvencyHeyElsa Staking Contract · CredShields · 8 Jan 2026Acknowledged
The report gives no description here.
Open the reportInformationalError message is not descriptive of the issue or the fixHeyElsa V2 · QuillAudits · 1 Jan 2026Acknowledged
The report gives no description here.
Open the reportInformationalHardcoded 1e18 Should Use Token DecimalsHeyElsa V2 · QuillAudits · 1 Jan 2026Acknowledged
The report gives no description here.
Open the reportInformationalclaimPartial cap Parameter Can Exceed Total Epochs, Silently Processing AllHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportInformationalMultiple Admin State-Change Functions Emit No EventsHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportInformationalOwnership Transfer Uses Single-Step Ownable Instead of Ownable2StepHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalSeasonEnded Event Missing epochsCheckpointed or Rewards Distributed FieldHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportInformationaltotalClaimable View Function Has Unbounded Loop, Potential Gas Exhaustion for On-Chain CallersHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportInformationalwasSeasonEligible Flag Cannot Be Cleared After Season TransitionHeyElsa Staking V2 · QuillAudits · 1 May 2026Fixed
The report gives no description here.
Open the reportInformationalMissing zero address validationsHeyElsa Airdrop Smart Contract · CredShields · 14 Jan 2026Fixed
The report gives no description here.
Open the reportInformationalUse Ownable2StepHeyElsa Airdrop Smart Contract · CredShields · 14 Jan 2026Fixed
The report gives no description here.
Open the reportGasCheaper conditional operatorsHeyElsa Staking Contract · CredShields · 8 Jan 2026Fixed
The report gives no description here.
Open the reportInformationalDevelopers Can Mislead Auditors And UsersHeyElsa Staking Contract · CredShields · 8 Jan 2026Fixed
The report gives no description here.
Open the reportGasGas Optimization in IncrementsHeyElsa Staking Contract · CredShields · 8 Jan 2026Fixed
The report gives no description here.
Open the reportGasGas Optimization for State VariablesHeyElsa (OFT bridge) · CredShields · 7 Jan 2026Fixed
The report gives no description here.
Open the reportInformationalestimateAPY() is misnamed, rewards are not compoundedHeyElsa V2 · QuillAudits · 1 Jan 2026Fixed
The report gives no description here.
Open the reportShow 2 more
InformationalUnrealistic assumedStake skews APR estimationHeyElsa V2 · QuillAudits · 1 Jan 2026Fixed
The report gives no description here.
Open the reportGasPublic constants can be privateHeyElsa Token Contract · CredShields · 31 Dec 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="heyelsa-oft-bridge"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us