Medium risk
app.hyperlend.finance
HyperEVM
Risk Index
35/ 100
This dApp appears to be related to staking and token management.
The report is marked Medium risk with a Risk Index of 35 due to the presence of an unverified contract and owner-controlled functions in the BeHYPE staking contract. Specifically, the unverified contract labeled 0xa462…4578 raises a significant red flag because its code cannot be reviewed. Additionally, the BeHYPE contract includes owner-controlled functions, which contribute to the risk score. Several checks could not be performed, including honeypot simulation and buy/sell tax analysis, due to the chain not being supported by the scanning tool. The scope of the report covers only the site's own contracts, excluding third-party tokens and bridges.
AIAI explanation, may be wrong
Red flags 2
Sorted by weight
-
+25
Contract code is not verified
The source code of unnamed contract (0xa462…4578) is not published on the explorer: nobody can check what the contract does.
-
+10
Owner-controlled functions in the code
The code has functions that let the owner change the rules: minting new tokens (BeHYPE (0xd8FC…DdA9)). They are not harmful by themselves, but dangerous in the hands of a single wallet.
Checklist
- Code verifiedNo
- Owner is a multisig or timelockOne wallet holds the keys to 1 of 10 contracts: LiquidationGuard (0xb58a…7511). 1 is held by a multisig or timelock.No
- Withdrawals not controlled by one walletUnknown
- Deployer is not a fresh walletYes
- Deployer has no abandoned projectsUnknown
- Contracts older than 7 daysYes
- Not a honeypotUnknown
Contracts 10 of 133
The contracts the site uses most
| Name | Role | Chain | Address | Verified | Owner | Age |
|---|---|---|---|---|---|---|
|
LiquidationGuard
This contract likely manages liquidation protections and caps within the protocol, handling keeper roles and oracle guards to maintain system health. AI |
— | HyperEVM | 0xb58a…7511 | Yes | Wallet | 10mo |
|
PoolInstance via proxy
This proxy contract represents a pool instance that manages lending and borrowing operations, reserve configurations, and flash loans in the protocol. AI |
Pool | HyperEVM | 0x00A8…1A8b | Yes | No owner() | 18mo |
|
AaveProtocolDataProvider
This contract provides data about the protocol's reserves, tokens, and user positions, serving as a data provider for other components. AI |
— | HyperEVM | 0x5966…5CFB | Yes | No owner() | 6mo |
|
CapAutomator
This contract automates the management of borrowing and supply caps within the pool, controlling configurations and updates related to caps. AI |
— | HyperEVM | 0x01f5…A312 | Yes | No owner() | 5mo |
|
AaveOracle
This contract serves as the price oracle, providing asset price data and managing fallback oracles and asset sources. AI |
Oracle | HyperEVM | 0xC9Fb…630e | Yes | No owner() | 18mo |
|
PendlePrincipalToken
This contract implements a principal token related to Pendle Finance, handling minting, burning, and expiry logic for yield tokens. AI |
Token | HyperEVM | 0xea84…C9f5 | Yes | No owner() | 10mo |
|
BoringVault
This contract is a vault that manages token deposits and withdrawals, supports multiple token standards, and includes authority and hook mechanisms. AI |
Vault | HyperEVM | 0x1359…0dE8 | Yes | Multisig | 15mo |
|
PendlePrincipalToken
This contract is another instance of a Pendle principal token with similar functionality for minting, burning, and expiry management. AI |
Token | HyperEVM | 0x50fC…7391 | Yes | No owner() | 4mo |
|
BeHYPE via proxy
This contract likely manages a staking token called BeHYPE, allowing minting, burning, and transfer of tokens, and includes upgradeability features via UUPS proxy pattern. AI |
Staking | HyperEVM | 0xd8FC…DdA9 | Yes | No owner() | 12mo |
|
Unnamed contract
This contract's purpose is unknown due to lack of verification and absence of function or event information; it is likely a utility or data provider contract. AI |
— | HyperEVM | 0xa462…4578 | No | No owner() | 15mo |
The site references 123 more contracts that no other team is known to own. Aegis checks the 10 the site relies on most; the rest were not checked and do not count in the Risk Index.
Other teams' contracts this site uses 2
Tokens and services built by other teams. Not checked and not part of the Risk Index
| Contract | Chain | Address | Why it belongs to another team |
|---|---|---|---|
| wstHYPE token | HyperEVM | 0x94e8…CF38 | Also used by 3 other sites (app.hypervault.finance, app.kittenswap.finance, kinetiq.xyz), and its deployer has no link to this site's own contracts |
| kHYPE token | HyperEVM | 0xfD73…296D | A token deployed by 0xb05c…2509, a busy wallet (698 transactions) with no link to the wallets behind this site's own contracts |
Not checked
These never count as passed
-
Honeypot simulation
GoPlus does not cover this chain: no buy / sell simulation ran · 5 contracts
-
Buy / sell tax
GoPlus does not cover this chain: no buy / sell simulation ran · 5 contracts
-
Who owns the contract
No owner() function; other access control (roles, a governor) is not checked yet · 8 contracts
What Aegis knows about this team
-
0x1B7a…C9Da Deployer on HyperEVM
- Wallet age
- 19mo
- First funded by
- 0x1670…0a0D
- Contracts created before
- 50+
- Deployed here
- PoolInstance, AaveProtocolDataProvider, CapAutomator, AaveOracle, Unnamed contract
- Its contracts in Aegis data
- 55
-
0xd4e8…AC4b Deployer on HyperEVM
- Wallet age
- 13mo
- First funded by
- 0x0000…2c0C
- Contracts created before
- 21
- Deployed here
- LiquidationGuard
- Its contracts in Aegis data
- 22
-
0x98FA…a52b Deployer on HyperEVM
- Wallet age
- 13mo
- First funded by
- 0xD3A1…43b9
- Contracts created before
- 46
- Deployed here
- PendlePrincipalToken
- Its contracts in Aegis data
- 47
-
0x0435…010c Deployer on HyperEVM
- Wallet age
- 19mo
- First funded by
- 0x6E6a…6045
- Contracts created before
- 7
- Deployed here
- BoringVault
- Its contracts in Aegis data
- 9
- Also behind
- app.kittenswap.finance (No red flags found)
-
0x0a4A…ceE7 Deployer on HyperEVM
- Wallet age
- 14mo
- First funded by
- HyperCore (Hyperliquid L1)
- Contracts created before
- 0
- Deployed here
- PendlePrincipalToken
- Its contracts in Aegis data
- 1
-
0xd8F3…2550 Deployer on HyperEVM
- Wallet age
- 15mo
- First funded by
- HyperCore (Hyperliquid L1)
- Contracts created before
- 8
- Deployed here
- BeHYPE
- Its contracts in Aegis data
- 9
Links on the site
This report describes on-chain facts and risk signals found by automated checks. Not financial advice: do your own research before you sign anything.