In the contract `HECMinter`, the role `owner` has authority over the following functions:
- `renounceManagement()`
- `pushManagement()`
- `setHec()`
- `setTrasury()`
- `setLimit()`
- `setTORMinter()`

In the contract `HECMinter`, the role `TORMinter` has authority over the following functions:
- `mintHEC()`
- `burnHEC()`

In the contract `TORMinter`, the role `owner` has authority over the following functions:
- `renounceManagement()`
- `pushManagement()`
- `setHec()`
- `setTOR()`
- `setHECMinter()`
- `setMintStrategy()`
- `setMintFee()`
- `setRedeemFee()`
- `setDaiLpSwapRouter()`
- `setUsdcLpSwapRouter()`
- `collectFee()`
- `redeemToDai()`
- `redeemToUsdc()`

In the contract `TOR`, the role `owner` has authority over the following functions:
- `renounceManagement()`
- `pushManagement()`
- `setMinter()`


Any compromise to the `owner`/`TORMinter` account may allow a hacker to take advantage of this authority.

Centralization Related Risks

According to the [official document](https://docs.hector.finance/the-tor-stablecoin/how-tor-works), the contract is serving as the underlying entity to interact with third-party `Curve Pool` protocols. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

In the following scenario, the renounced ownership can be owned again.

1. The current `owner` A call the `pushManagement()` function first. And the new owner candidate B calls the `pullManagement()` function to get the ownership of the contract. 
2. After a few months, owner B calls the `renounceManagement()` function to renounce the ownership. And the state variable `_owner` is `address(0)` now.
3. Because within the `pullManagement()` function, the state variable `_newOwner` is not reset, its value is still owner B now.
4. When owner B calls the `pullManagement()` function again, he/she can pass the check at L466 and set the `_owner` to `_newOwner` whose value is owner B.

Missing Reset `_newOwner`

The linked `transfer()`/`transferFrom()` invocations do not check the return value of the function call which should yield a `true` result in case of proper ERC-20 implementation.

Unchecked Value of ERC-20 `transfer()`/`transferFrom()` Call

We checked the linked four addresses on FTMScan website. And get the following information:

- 0x243bE5DF259a4a8c14dD6eED87129aF01bc8f03a Not verify and publish
- 0xCB54EA94191B280C296E6ff0E37c7e76Ad42dC6A HectorTreasury
- 0x79f29359E6633120c86Ba0349551e134d13fc487 MHEC (MockHector)
- 0x5C4FDfc5233f935f20D2aDbA572F770c2E377Ab0 HectorToken

Hardcode Address

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

Function name is mistakenly set as `setTrasury()`.

Function Name Typo

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Statements

Within the `setTORMinter()` function, setting the TORMinter to the zero address is already avoided. So the boolean expression `TORMinter != address(0)` at L507 and L514 doesn't need.

The linked variables are assigned only once, either during their contract-level declaration or during the `constructor`'s execution.

Mutability Specifiers Missing

The second parameter of the `swapExactTokensForTokens()` function is `amountOutMin` and its pass-in value at L583 is `1`. If the swap operation is successfully executed, the swapped out token amount, which is stored in `amountsOuts[1]`, must be greater than `1`. The boolean expression `amountOuts[1] > 0` definitely returns true.

Detects the comparison to boolean constants. Boolean constants can be used directly and do not need to be compare to true or false.

Boolean Equality

The `mintWithDai()` and `mintWithUsdc()` functions, which are used to mint TOR by transferring in DAI or USDC when the TOR stable coin value is greater than \$1, can be accessed by any user. However, the `redeemToDai()` and `redeemToUsdc()` functions, which are used to redeem DAI or USDC by transferring TOR when TOR stable coin value is less than \$1, only can be accessed by the `owner`. So the user who holds the TOR token can't redeem DAI/USDC tokens and the price of the TOR stable coin can not up to \$1 as soon as possible.

Unreasonable Function Access Restriction

The state variable `hec`/`TOR` is assigned the `HEC`/`TOR` ERC20 token address. Generally, the ERC20 token address is never changed. However, in the codebase, the `setHec()`/`setTOR()` function can change the `hec`/`TOR` to another `HEC`/`TOR` contract address.

Unclear Purpose Of `setHec()`

The given input is missing the check for the non-zero address.

Missing Input Validation

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by back running (after the transaction being attacked) a transaction to sell the asset.

The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large:

- `mintWithStable()`
- `redeemToStable()`

Potential Sandwich Attacks

The function that affects the status of sensitive variables should be able to emit events as notifications to change the minter.
- `setMinter`

Exchange	Pair	Price	Spread	24H Volume	24H Vol USD	Volume %

No Data

TOR

Highlights & Alerts

Long-running Project

Trust Score is in Top Quartile amongst all projects

Code Audit History

19

0

18

0

1

Skynet

Sentiment Analysis

Market Volatility