Which HEX audits exist?
| Audit | Date | Scope | Result | Status |
|---|---|---|---|---|
| CoinFabrik — security | December 2019 | repository gitlab.com/bitcoinhex/contract-staging, commit b0a5f8e5… updated to 67bd0093… |
0 critical, 0 medium, 3 minor issues, 4 enhancements | published (PDF on hex.com) |
| CoinFabrik — economics (“Financial Analysis of Stakes”) | October 2019 | commit 640906556dd1… |
longer stakes pay better than short re-compounding stakes, for realistic parameters | published (PDF on hex.com) |
| ChainSecurity — security | announced 2019 | — | — | no report found (re-checked 2026-10-17) |
Only the two CoinFabrik reports can be read and checked. ChainSecurity is listed because hex.com names it; no report from it has been published.
What did the CoinFabrik security audit find?
No critical and no medium issues. The three minor findings can be traced in the deployed contract:
| Finding | Outcome in the deployed code | Code |
|---|---|---|
| Only the first 8 bytes of the claim-parameter hash were signed, so a precomputed collision could hijack a claim made on someone else’s behalf. The auditor recommended at least 16 bytes, or allowing only self-claims | raised from 8 to 12 bytes (CLAIM_PARAM_HASH_BYTE_LEN = 12) — less than the recommended 16; the auditor rated the issue minor because such claims were not part of the user interface and a collision was very unlikely |
HEX.sol:747 |
| Gas cost of long payout loops | maximum stake length lowered to 5,555 days | HEX.sol:714 |
| Payable fallback function | kept: the contract accepts ETH sent directly | HEX.sol:2951 |
The report adds four enhancement suggestions and concludes that the code is well written and documented. The audit covered the staging repository at the commits above; the deployed source itself is verified on both explorers and can be read directly.
What did the economics audit check?
It tested the central promise of the staking design: that committing to one long stake pays better than repeatedly re-staking short ones. CoinFabrik confirmed this for realistic parameters and documented a single edge case — one staker alone with an artificially low share rate — which the report treats as unrealistic. How the share rate produces this effect is explained in Staking.
Was there a ChainSecurity audit?
hex.com lists ChainSecurity as a second auditor but links only ChainSecurity’s homepage, not a report. Archived copies of the earlier official site hex.win from 2019-12-05, 2020-03-01 and 2020-12-01 said the ChainSecurity report would be released later because that review was more complex. The Wayback Machine indexes of hex.win/docs and hex.com/_assets/docs contain the two CoinFabrik PDFs (and, on hex.com, the whitepaper), but no ChainSecurity file.
Status on 2026-10-17: announced, not published. If the report appears, this page will be updated.
What does an audit not tell you?
An audit describes code at a specific commit on a specific date. Because the HEX contract has no owner and no upgrade mechanism, the code that runs today is the code that was deployed in December 2019 — on PulseChain as well, where the bytecode is identical (HEX vs. HEX(eth)). Anyone can read that verified source on the explorer; this portal’s explanations cite it line by line.