Audit report published Nov 2025. Solana · Rust (Anchor).
| Severity | Count |
|---|---|
| Critical | 1 |
| High | 1 |
| Medium | 4 |
| Low | 2 |
| Total | 8 |
Safe Edges reviewed Luxxcoin's HeroRewards program on Solana, written in Rust with Anchor, in November 2025. Eight issues were identified: one Critical, one High, four Medium and two Low. The Critical issue computed each round's end time as its start time, so any round could be closed the moment it opened and no rewards distributed. Luxxcoin fixed seven issues and acknowledged one, the missing deadline check on reward distribution.
C-01 Incorrect Round End-Time Calculation Allows Immediate Round Closure — ResolvedH-01 Permanent Token Lockout Due to Missing Withdrawal Mechanism — ResolvedM-01 Missing Deadline Enforcement Allows Late Reward Distribution — AcknowledgedM-02 Governance Can Modify Round Cadence, Breaking Immutable Schedule Guarantee — ResolvedM-03 Missing Round Start Time Validation Allows Premature Round Initialization and Schedule Bypass — ResolvedM-04 Missing Prefund Validation Allows Premature Round Initialization and Distribution — ResolvedL-01 Missing Duplicate Address Check in distribute_batch Allows Double Payouts — ResolvedL-02 Missing Automatic Round Finalization Allows Inconsistent Round State — ResolvedSend the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.