Security audit: first report published
SolidProof has audited six of our contracts. The report is live and you can read every line of it.
https://app.solidproof.io/projects/hcow
The numbers
6 contracts, 1,511 lines. Token, Vesting, Staking, Ledger,
ProfitShare, Faucet.
Critical: 0
High: 0
Medium: 4
Low: 20
Every finding is listed with the auditor's recommendation. None of it sits behind a summary.
On the vesting contract
This is the part that decides whether a team can move tokens that were promised to someone else. From the report:
There is no revoke, no clawback, no sweep and no emergency withdrawal. The launch timestamp is fixed at deployment and cannot be moved. Once the schedule is sealed the owner has no remaining power over the contract, and cannot pause, block or delay any release. Releases are permissionless and always pay the beneficiary, never the caller.
The vesting arithmetic was verified symbolically. A release can
never exceed an allocation, and the full allocation is reachable
exactly at maturity.
On the medium findings
The most significant one is not in the vesting logic. It is in the funding procedure. If the contract is funded with anything other than the exact committed total, the tokens cannot be recovered afterwards. The auditor's fix is to check live supply before funding and to make funding and sealing a single atomic transaction. We are doing both, and we will not deploy to mainnet until they are in place.
What happens next
We are addressing every finding and submitting an updated codebase for re-audit. SolidProof has allocated the slot. The audit is not finished until that second report is published, and we will not call it finished before then.
KYC is running alongside, with one step left on our side this week.
Nothing is deployed to mainnet yet. The report lists contract addresses as N/A because they do not exist.
