The claim
“HEX has an admin key — an owner who can mint, freeze accounts or change the rules.”
A recurring claim; no single original source is attributed here.
What the code shows
The verified source has no owner variable, no onlyOwner, no pause, no blacklist, no upgrade proxy, no selfdestruct and no delegatecall. Stake limits, bonuses and penalty rules are constants (HEX.sol:632-748), the inflation rate is a literal number in the payout formula (:1241), and all nine _mint calls sit inside public, rule-based functions. Read the verified source.
What exactly is claimed?
That HEX, like many tokens, hides privileged functions: an owner who could create new HEX, freeze or blacklist holders, pause transfers, or upgrade the contract to new rules. As a general warning this is sound advice — many tokens do have such functions, and checking for them is the first step of any token review. The question is whether HEX has them.
What does the code show?
A full-text search of the verified source for owner, Ownable, onlyOwner, selfdestruct, delegatecall, pause and upgrad finds nothing that gives anyone special rights. The only owner hits are the standard ERC-20 allowance parameters (HEX.sol:55-60, :322-323, :452-469).
| Mechanism a token could hide | In HEX? |
|---|---|
| Owner / admin role | no |
| Mint function callable at will | no — nine _mint calls, all inside public rules (:1298, :1484, :1804, :2458, :2525, :2529, :2773, :2784, :2787) |
| Pause or freeze | no |
| Blacklist | no |
Upgrade proxy or delegatecall |
no |
selfdestruct |
no |
| Changeable inflation, penalties, stake limits | no — constants (:632-748) and a literal number in the payout formula (:1241) |
The contract is built as a straight chain of inheritance — ERC-20 → GlobalsAndUtility → StakeableToken → UTXOClaimValidation → UTXORedeemableToken → TransformableToken → HEX (:283, :484, :1315, :1948, :2277, :2692, :2933) — and its staking logic makes no calls to external contracts (:1222-1257, :1571-1594).
Is it different on PulseChain?
No. The runtime bytecode at the same address on PulseChain has the same SHA-256 hash as on Ethereum, so the same absence of admin functions applies to HEX on PulseChain (HEX vs. HEX(eth)).
What did the audit find?
CoinFabrik’s security audit of December 2019 found 0 critical and 0 medium issues, with three minor findings that are visible as fixes or deliberate choices in the deployed code (HEX audits).
Is there any limitation worth knowing?
The absence of an admin key cuts both ways: nobody can fix a bug, rescue a lost stake or reverse a mistaken transaction either. A stake ended early pays its penalty; HEX sent to a wrong address is gone.
Verdict
False. HEX has no admin key and no backdoor. Its rules have been fixed since deployment on 2019-12-03 and can be read by anyone in the verified source.