GoPlus: Hello 402, the contract poses risks of infinite issuance and centralized manipulation.

Deep Tide TechFlow News, November 12th, analysis on social platforms by GoPlus states that the Hello 402 contract has some hidden risks—namely, unlimited issuance and centralized manipulation vulnerabilities.

1. The administrator address has extremely high permissions, fully controlling the minting and distribution of H402 tokens. For example:

• The addTokenCredits function allows the administrator to allocate H402 token minting shares to users but does not check whether it exceeds the MAX_SUPPLY total, creating a potential backdoor for unlimited issuance;

• The redeemTokenCredits function enables users to mint H402 tokens based on their shares;

• The WithdrawDevToken function allows the administrator address to mint all unallocated shares at once, posing a high risk of centralized manipulation.

2. The project team’s statement on X indicates that the WithdrawDevToken function is only used for “token replenishment,” “ecosystem incentives,” and “profit sharing” after private placement, with no specific implementation at the contract level, which presents a high risk of centralized default.