Phalcon checkHash返回false（总是）

Question

I'm struggling with a problem. I use the Phalcon framework.

The problem is, the $this->security->checkHash() function always returns false.

What I've checked so far: Checked the length of the varchar password field (is 255) so the hash should fit perfectly inside the field.

Currently, the code looks like this:

The register function:

public function registerAction()
{
    $postData = $this->request->getPost();

    /*
     * Validation
     */
    $validation         = new  RegistrationValidation();
    $validationMessages = $validation->validate($postData);

    if (count($validationMessages)) {
        // Validation Failed!
        foreach ($validationMessages as $message)
            $this->flashSession->error( $message);
        $this->response->redirect( $_SERVER['HTTP_REFERER'] );
        $this->response->send();
    } else {
        // Check Passwords Match
        if($postData['password'] !== $postData['password-repeat']) {
            $this->flashSession->error( "Passwords don't match");
            $this->response->redirect( $_SERVER['HTTP_REFERER'] );
            $this->response->send();
        }
    }

    /**
     * Begin registration Process
     */
    $user = new Users();

    $password = $this->request->getPost('pawword');
    $password = $this->security->hash($password);

    $user->username     = $this->request->getPost('username');
    $user->email        = $this->request->getPost('email');
    $user->register_ip  = $_SERVER['REMOTE_ADDR'];
    $user->password     = $password;
    $user->active       = 0;

    // Store user
    $user->save();
    $this->view->emailmsg = $this->sendVerificationMail($user->id, $user->email, $user->username);
}

the login function:

public function loginAction()
{
    if ($this->request->isPost()) {

        $email = $this->request->getPost("email");
        $password = $this->request->getPost("password");

        var_dump($password);

        $user = Users::findFirstByEmail($email);


        var_dump($this->security->checkHash( 'edrsvc', '$2y$12$ZERPY2Q3N0hUdG1XSkw5V.DqhYek97IZyrRQwq/UP/X7xO3PiPIpG' ));

        var_dump($this->security->checkHash($password,  $user->password));
        var_dump(password_verify('edrsvc',  '$2y$12$ZERPY2Q3N0hUdG1XSkw5V.DqhYek97IZyrRQwq/UP/X7xO3PiPIpG'));



        die();
        if ($user) {
            if ($this->security->checkHash($password, $user->password)) {

                var_dump($user);
                die();


                $this->_registerSession($user);

                $this->flash->success(
                    "Welcome " . $user->name
                );

                // Forward to the 'invoices' controller if the user is valid
                $this->dispatcher->forward(
                    [
                        "controller" => "index",
                        "action" => "index",
                    ]
                );
            }
        } else {

            $this->security->hash(rand());

            $this->flashSession->error(
                'Wrong Email or password <a href="#">Back</a>'
            );

        }
    }
}

You can see those 3 var_dumps, which are actually functioning and not throwing exceptions, but always return false. The password is of course correct and checked twice.

The workFactor is set to Phalcon's default workFactor.