Medium risk · app.hyperbeat.org

Medium risk

app.hyperbeat.org HyperEVM

Risk Index

45/ 100

Scanned 3 hours ago · 10 of 187 contracts checked · https://app.hyperbeat.org/earn?referral=5C37264D

This dApp appears to manage tokenized accounts, vaults, and staking functionalities.

The report assigns a Medium risk status with a risk index of 45 due to several red flags. Four contracts are unverified, which increases uncertainty about their code and behavior. Additionally, two contracts labeled BeHYPE and USDG0 contain owner-controlled functions, which may allow privileged actions. Some checks could not be performed, including honeypot simulation and buy/sell tax analysis, due to chain support limitations. The scope of the report covers only the site's own contracts, excluding third-party tokens, bridges, and widgets.

AIAI explanation, may be wrong

Red flags 2

Sorted by weight

Contract code is not verified

The source code of unnamed contract (0xb907…eEb6), unnamed contract (0xb4a0…e0dA), unnamed contract (0x7ab1…9e69) and 1 more is not published on the explorer: nobody can check what the contract does.
+25
Owner-controlled functions in the code

The code has functions that let the owner change the rules: minting new tokens (BeHYPE (0xd8FC…DdA9), USDG0 (0x9522…1505)), pausing (USDG0 (0x9522…1505)). They are not harmful by themselves, but dangerous in the hands of a single wallet.
- BeHYPE0xd8FC…DdA9
- USDG00x9522…1505
+20

Checklist

Code verifiedNo
Owner is a multisig or timelockOne wallet holds the keys to 2 of 10 contracts: FactoryStaker (0xd703…42d5), unnamed contract (0xb907…eEb6). 4 are held by a multisig or timelock.No
Withdrawals not controlled by one walletUnknown
Deployer is not a fresh walletYes
Deployer has no abandoned projectsUnknown
Contracts older than 7 daysYes
Not a honeypotUnknown

Contracts 10 of 187

The contracts the site uses most

Name	Role	Chain	Address	Verified	Owner	Age
BeHYPE via proxy This contract likely manages a staking token called BeHYPE, allowing minting, burning, and transfer of tokens, and includes upgradeability features via UUPS proxy pattern. AI	Staking	HyperEVM	0xd8FC…DdA9	Yes	No owner()	12mo
TokenizedAccount via proxy This contract likely manages tokenized accounts, allowing deposits, withdrawals, fee management, and blacklist controls, serving as a proxy for upgradeability. AI	—	HyperEVM	0x96C6…B1FB	Yes	Multisig	18mo
TokenizedAccount via proxy This contract appears similar to the other TokenizedAccount proxy, handling tokenized assets with features like deposits, withdrawals, and fee processing. AI	—	HyperEVM	0xc061…4F94	Yes	Multisig	17mo
BoringVault This contract seems to be a vault managing token deposits and withdrawals, with support for ERC1155 and ERC721 tokens and authority control. AI	Vault	HyperEVM	0x669a…0Cc1	Yes	Multisig	10mo
FactoryStaker This contract likely manages staking related to a factory, including ownership handover and stake management functions. AI	Staking	HyperEVM	0xd703…42d5	Yes	Wallet	18mo
Unnamed contract The code is not verified, so the purpose of the contract is unknown.	—	HyperEVM	0xb907…eEb6	No	Wallet	9mo
Unnamed contract The code is not verified, so the purpose of the contract is unknown.	—	HyperEVM	0xb4a0…e0dA	No	Multisig	2mo
Unnamed contract The code is not verified, so the purpose of the contract is unknown.	—	HyperEVM	0x7ab1…9e69	No	No owner()	12mo
Unnamed contract The code is not verified, so the purpose of the contract is unknown.	—	HyperEVM	0x4c70…445a	No	No owner()	9mo
USDG0 via proxy A proxy that forwards calls to USDG0; looks like a token.	Token	HyperEVM	0x9522…1505	Yes	Contract	10mo

The site references 177 more contracts that no other team is known to own. Aegis checks the 10 the site relies on most; the rest were not checked and do not count in the Risk Index.

Other teams' contracts this site uses 8

Tokens and services built by other teams. Not checked and not part of the Risk Index

Contract	Chain	Address	Why it belongs to another team
wNLP token	HyperEVM	0x4Cc2…9bbA	A token deployed by 0x002b…bAB2, a busy wallet (16,904 transactions) with no link to the wallets behind this site's own contracts
hbUSDT token	HyperEVM	0x5e10…61eb	A token deployed by 0x0144…4F0F, a busy wallet (237 transactions) with no link to the wallets behind this site's own contracts
lstHYPE token	HyperEVM	0x81e0…2A76	A token deployed by 0x0144…4F0F, a busy wallet (237 transactions) with no link to the wallets behind this site's own contracts
liquidHYPE token	HyperEVM	0x4417…9D29	A token deployed by 0x0144…4F0F, a busy wallet (237 transactions) with no link to the wallets behind this site's own contracts
hbUSDC token	HyperEVM	0x057c…8a61	A token deployed by 0x0144…4F0F, a busy wallet (237 transactions) with no link to the wallets behind this site's own contracts
BPLPT token	HyperEVM	0x53F9…8425	A token deployed by 0x002b…bAB2, a busy wallet (16,904 transactions) with no link to the wallets behind this site's own contracts
kHYPE token	HyperEVM	0xfD73…296D	Also used by 3 other sites (app.hyperlend.finance, app.kittenswap.finance, kinetiq.xyz), and its deployer has no link to this site's own contracts
masterUSD token	HyperEVM	0x9065…4B03	A token deployed by 0x2F3A…9fc8, a busy wallet (3,484 transactions) with no link to the wallets behind this site's own contracts

Not checked

These never count as passed

Honeypot simulation

GoPlus does not cover this chain: no buy / sell simulation ran · 9 contracts
Buy / sell tax

GoPlus does not cover this chain: no buy / sell simulation ran · 9 contracts
Who owns the contract

No owner() function; other access control (roles, a governor) is not checked yet · 3 contracts

What Aegis knows about this team

0xc573…A67F Deployer on HyperEVM

Wallet age
18mo

First funded by
HyperCore (Hyperliquid L1)

Contracts created before
47

Deployed here
TokenizedAccount, TokenizedAccount

Its contracts in Aegis data
49
0x9775…aE8A Deployer on HyperEVM

Wallet age
19mo

First funded by
HyperCore (Hyperliquid L1)

Contracts created before
0

Deployed here
FactoryStaker, Unnamed contract

Its contracts in Aegis data
2
0xA552…646D Deployer on HyperEVM · deployment service

Wallet age
10mo

First funded by
0x8F0b…Ae1F

Contracts created before
0

Deployed here
Unnamed contract, Unnamed contract
0xd8F3…2550 Deployer on HyperEVM

Wallet age
15mo

First funded by
HyperCore (Hyperliquid L1)

Contracts created before
8

Deployed here
BeHYPE

Its contracts in Aegis data
9

Also behind
app.hyperlend.finance (Medium risk)
0x1Ab5…68E5 Deployer on HyperEVM

Wallet age
10mo

First funded by
0xF545…a30F

Contracts created before
4

Deployed here
BoringVault

Its contracts in Aegis data
5
0x62CC…a943 Deployer on HyperEVM

Wallet age
8mo

First funded by
0x43cb…4a5d

Contracts created before
50+

Deployed here
Unnamed contract

Its contracts in Aegis data
51
0x4D27…063C Deployer on HyperEVM

Wallet age
10mo

First funded by
0xBaEb…C9f7

Contracts created before
5

Deployed here
USDG0

Its contracts in Aegis data
6

Other sites that use the same contracts: app.hyperlend.finance (Medium risk). The same team, or one site copying the other: make sure you opened the address you meant to.

Links on the site

This report describes on-chain facts and risk signals found by automated checks. Not financial advice: do your own research before you sign anything.

Report a mistake in this report

Contract code is not verified

Owner-controlled functions in the code

Honeypot simulation

Buy / sell tax

Who owns the contract