Mellow Protocol audit
Audit competition · firm’s term: public best efforts audit contest
Sherlock reviewed Mellow (Mellow Protocol audit) on 28 Jul 2025: 15 findings, 0 critical; 13 marked fixed, 2 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings15
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 6 |
| Medium | 0 | 2 | 7 |
| Low | 0 | 0 | 0 |
HighConsensus.checkSignatures doesn't check duplication of signersFixed
The report gives no description here.
HighIncorrect performance fee calculation in FeeManagerFixed
The report gives no description here.
HighProtocol Fee Multiple Accrual in Oracle.submitReportsFixed
The report gives no description here.
HighRedeemQueue Accounting Mismatch Between Batch Creation and Claim EligibilityFixed
The report gives no description here.
HighRedeems through RedeemQueue avoid paying management and performance fee.Fixed
The report gives no description here.
HighUnable to withdraw native tokens because vault and redeem hooks do not handle native tokensFixed
The report gives no description here.
MediumcancelDepositRequest() always reverts due to modifying FenwickTree with wrong indexFixed
The report gives no description here.
MediumDoS in Redemption Due to Unchecked Asset Support in SubvaultsFixed
The report gives no description here.
MediumETH redemptions via SignatureRedeemQu eue are broken due to missing receive functionFixed
The report gives no description here.
MediumFlawed Logic in ShareManager Inverts Transfer Whitelist BehaviorFixed
The report gives no description here.
Show 3 more
MediumMalicious Users Can Perpetually Lock feeRecipient Shares via Targeted Lockup ResetFixed
The report gives no description here.
MediumProtocol Fee Exponential Compounding in ShareModule.handleReportFixed
The report gives no description here.
MediumTargeted-lockup bypass: freshly minted shares can be transferred immediately in the same transfer() or transferFrom() callFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Mellow’s security record
MellowSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us