## HAI Findings

### HAI severity
- LiquidationEngine:
- protectSAFE allows anyone to disable the protection
- malicious SafeSaviour can revert liquidation tx
- SurplusAuctionHouse: auctions cannot be settled if initialBid > 0
- HaiProxy: delegateCall does not revert if target doesn’t exist
- HaiProxyFactory: deployed Proxy address can be frontrunned
- TokenDistributor:
- sweep and withdraw have redundant functionalities
- claimAndDelegate uses nonce 0
- DelayedOracle: feed is always valid
- HaiSafeManager: transferSAFEOwnership uses the wrong destination id
- SafeManager: allows ppl to create safes in other’s account name (may be spammable)