20 August 2026

Initial source-code audit HPX-SRC-2026-08-20-A

First repository review: cycle spam, fee black hole, HPX1 calldata vs ABI, missing reentrancy guard, over-broad CSP, local mark-complete spam.

Effective 20 August 2026 · Last updated 20 August 2026

All audits · HPX-SRC-2026-08-20-A

Verdict

PASS WITH REMEDIATION (then superseded by B and C)

Scope: this interface and unpublished contract drafts. Out of scope: ProveX, PulseChain consensus, $PRVX bytecode, user devices. Not a warranty.

Findings

A-H5 — Unlimited confirmCycle. Cadence cooldown, archive block, max 16 habits, chain 1/369.

A-H6 — Fee black hole / ABI / reentrancy. undistributedFees, balance deltas, nonReentrant, encodeFunctionData.

Environment (not protocol bugs)

A stolen seed, a malicious browser extension, a fake ProveX domain you type yourself, or a lying RPC operator can still harm a user. Those are outside this contract set. The vault money path does not trust confirmCycle, localStorage, or OAuth.

Other reports

These documents are provided for transparency. They are not legal, tax, or investment advice. If you need advice for your situation, consult a qualified professional in your jurisdiction.