---
# System prepended metadata

title: 'HAI Findings [DEPRECATED]'
tags: [HAI]

---

## HAI Findings

### HAI severity
- LiquidationEngine:
    - protectSAFE allows anyone to disable the protection
    - malicious SafeSaviour can revert liquidation tx
- SurplusAuctionHouse: auctions cannot be settled if initialBid > 0
- HaiProxy: delegateCall does not revert if target doesn’t exist
- HaiProxyFactory: deployed Proxy address can be frontrunned
- TokenDistributor:
    - sweep and withdraw have redundant functionalities
    - claimAndDelegate uses nonce 0
- DelayedOracle: feed is always valid
- HaiSafeManager: transferSAFEOwnership uses the wrong destination id
- SafeManager: allows ppl to create safes in other’s account name (may be spammable)