Security model
What the contracts guarantee, who can change what, and the risks that remain. Read this before locking or vesting large amounts.
What the contracts guarantee
| Guarantee | Enforced by |
|---|---|
| A lock can never be shortened | Locker: a new date must be later |
| Only the lock owner withdraws, after the date | Locker |
| Vested tokens always go to the recipient | Vesting: anyone can trigger, nobody can redirect |
| Cancelling keeps what already vested | Vesting |
| Pending refuel payments stay refundable | Deposit contract: reserved funds can't be swept |
What the owner can change
The owner can set fees, the holder discount, refuel limits and the relayer, and can pause Refuel. The owner cannot touch locked or vesting tokens. See Contracts for the addresses.
How Refuel is protected
- The vault holds only a small working stock of HYPE.
- Caps per transaction, per wallet per day and per day limit what can leave.
- Each payment can be delivered only once.
- Both the vault and the deposit contracts can be paused.
How it's built
- OpenZeppelin 5.1: Ownable2Step, ReentrancyGuard, SafeERC20, Pausable.
- Foundry tests run on every change.
- Verified source on the Elysium explorer.
Report a problem
Found a bug or a vulnerability? Follow SECURITY.md on GitHub. Please don't post vulnerabilities publicly.