PANews reported on November 12 that the GoPlus Chinese community disclosed on the X platform that the Hello 402 contract has some hidden risks—unlimited issuance and the potential for centralized manipulation.

1. The administrator address has extremely high privileges, completely controlling the minting and distribution of H402 tokens. For example:

• The addTokenCredits function allows administrators to allocate H402 token minting shares to users, but it does not check whether this will exceed the total MAX_SUPPLY count, which is similar to creating an unlimited issuance backdoor.
• The redeemTokenCredits function allows users to actually mint H402 tokens based on their share.
• The WithdrawDevToken function allows the administrator address to mint all unallocated tokens at once, which carries a high risk of centralized manipulation.

2. The WithdrawDevToken function declared by the project team in X is only used for promises such as "token replenishment", "ecosystem incentives" and "profit margins" after the private sale ends. None of these promises are specifically implemented at the contract level, resulting in a high risk of centralized default.

As previously reported yesterday, OKX stated that it has launched an investigation into the abnormal behavior of Hello402, will continue to track on-chain evidence, and reserves the right to take legal action.