Sherpa Audit Report
Cyfrin reviewed Sherpa (Sherpa Audit Report) on 23 Nov 2025: 6 findings, 0 critical; all marked fixed.
No open critical findings
Open the reportOpen Sherpa’s security record
Report hosted on GitHub.
Trustblock does not review code.
Findings6
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 0 | 3 |
MediumOwner can chain admin calls for same-block drainsFixed
The report gives no description here.
MediumOwner can rescue the vault’s own share tokensFixed
The report gives no description here.
MediumWithdrawals can effectively only happen on the primary chain after any yield has accruedFixed
The report gives no description here.
LowDirect amount assignment in SherpaUSD::ownerMint/ownerBurn can break accounting for totalStaked and accountingSupplyFixed
The report gives no description here.
LowMisconfigured decimal scale can skew vault accountingFixed
The report gives no description here.
LowSherpaUSD does not work with fee-on-transfer tokensFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Sherpa’s security record
SherpaAudits1 audit by 1 firmLast audit Nov 2025, by Cyfrin.
Critical findingsNo open critical findingsIn 1 report.
Open Sherpa’s security recordSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us