Summary
Scope, code version, methods used and an overview of the results.
Hylox Security / Reports
Audit reports
What you receive at the end of an audit, and how every finding is rated.
What every report contains
Findings
Every issue with its severity, location, impact and recommended fix.
Fix status
Whether each finding was fixed, partly fixed or acknowledged.
Severity scale
| Severity | What it means |
|---|---|
| Critical | Funds can be stolen or permanently lost, or the system can be taken over. Fix before launch. |
| High | Serious loss or disruption is possible under realistic conditions. Fix before launch. |
| Medium | Harm is possible but limited, or needs unusual conditions. Fix soon. |
| Low | Minor issue with little direct impact. Fix when convenient. |
| Informational | Best-practice and code-quality notes. No direct risk. |
Example finding
An illustrative example of how a finding is presented.
41function withdraw(uint256 amount) external {42 require(balances[msg.sender] >= amount, "Insufficient");43 (bool ok, ) = msg.sender.call{value: amount}("");44 require(ok, "Transfer failed");45 balances[msg.sender] -= amount; // updated after the call46}
Reentrancy in withdraw()
The contract sends funds before it reduces the caller’s balance.
- Impact
- A malicious contract can call withdraw() again during the transfer and drain the vault.
- Recommendation
- Reduce the balance before the external call, or add a reentrancy guard.
- Status
- Fixed Verified in the re-check
Published reports
Final reports that clients choose to make public are listed here.
Verify a report
To confirm a report that claims to be from Hylox Security, email [email protected] with the project name and report date.