Read the findings of the 2022 Web3 Security Report

Missing Emit Events

Improper usage of `public` and `external` type

Question Related to `_hdrnFlowAddress`

Check-effect-interaction Pattern Violation

Missing Input Validation

Question Related to Bonus Copy

Dangerous Use of `_burn()`

Token Distribution to `_hdrnSourceAddress`

Not Updated Launch Bonus

`_mintedDays` Not Updated In Function `mintInstanced()`

Error In Premium Payoff Calculation

Missing Sanity Checks

Missing Updates With `mintedDays` When Adding New Shares

Redundant Code Components

The purpose of function `proofOfBenevolence`

Hedron Audit

HEXStakeInstanceManager.sol

Hedron.sol

HEXStakeInstance.sol

Hedron

There should always be events emitted in the sensitive functions.

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

`_hdrnFlowAddress` is set to receive royalty payments from trading HSI ERC721 tokens. However, we don't have enough information about this address. 

  The value of `hexBalance[msg.sender]` is updated after the function `_hx.transferFrom(msg.sender, whoami, amount)` or `_hx.transfer(msg.sender, amount)` is called, which violates the check-effect-interaction pattern.

The function `_dailyDataLoad` doesn't check if the the current hex day is more than 2. Neither does the function `_hexDailyDataLoad()` check that. 

Function `mintInstanced()` and function `mintNative()` add `payout` to `day._dayMintedTotal`, but they actually minted double `payout` amount of tokens. 

When a user is paying off his loan or liquidating other users' loan, the contract uses `_burn` instead of `burnFrom`, which allows the contract to burn user's token without approval.

In function `mintInstancedUnrealized()` and function `_shareSearch()`, all unrealized HDRN tokens are minted to the source address `_hdrnSourceAddress`. Also, function `mintInstanced()` and `mintNative()` call `_mint(_hdrnSourceAddress, bonus)` to mint the same amount of tokens as `payout` to `_hdrnSourceAddress`.

The parameter `share._launchBonus` is not updated each time when function `mintInstanced()` and function `mintNative()` are called, which makes it a multiplier that continually applies on bonus. We're not sure if it's an intended design. If so, users might make a less profit when they don't call function `mintInstanced()` and function `mintNative()` as soon as the stake is not pending. 

`share._mintedDays` is not updated after minting in function `mintInstanced()`. Users could keep calling function `mintInstanced()` to gain extra HDRN tokens. 

In function `calcLoanPayoff()`, function `loanPayoff()` and function `loanLiquidate`, they use principal payoff `share._stake.stakeShares * loanTermRemaining` in premium payoff calculation, while they should use `share._stake.stakeShares * outstandingDays` as current principal. 

In function `calcLoanPayoff()` and function `loanPayoff()`, if a user already passes the final due day but no longer than 60 days, his premium payoff would be higher than expected since the `outstandingDays` is larger than `loanTermRemaining`. 

In function `loanLiquidate()`, a user only needs to pay the interest to the current Hedron day. 

When creating a new share element for the sender in function mintNative(), the function uses 0 as `mintedDays` while the sender has already received minted tokens. 
```solidity=
            _shareAdd(
                HEXStakeMinimal(stake.stakeId,
                                stake.stakeShares,
                                stake.lockedDay,
                                stake.stakedDays
                ),
                0,
                launchBonus
            );
```

There is no need to update `liquidation._liquidationStart` since it shouldn’t be changed. 

The function `proofOfBenevolence` can be called by anyone. It accepts an uint256 number parameter `amount`. The function reduces the HDRN token balance of the caller by `amount`. 

Hedron

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

15

0

5

0

10