Delpho audit
Audit · firm’s term: collaborative audit
Sherlock reviewed Delpho (Delpho audit) on 22 Apr 2026: 44 findings, 0 critical; 40 marked fixed, 4 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings44
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 0 | 13 |
| Low | 0 | 4 | 24 |
HighAccrued interest is silently destroyed during fallback redemption instead of being paid to the fee receiverFixed
The report gives no description here.
HighAccrued interest is silently destroyed during liquidation instead of being paid to the fee receiverFixed
The report gives no description here.
HighHyperLend Rewards Controller Rewards Are Never Claimed or ForwardedFixed
The report gives no description here.
MediumChainlink feed parameters cannot be safely updated after token registrationFixed
The report gives no description here.
MediumDelphoStaker reward distribution can be frontrun to steal yield from existing stakersFixed
The report gives no description here.
MediumDisabling a collateral token reverts price reads and blocks liquidation and withdrawal of existing holdersFixed
The report gives no description here.
MediumFallback redemption against an underwater borrower can create a stuck active position with debt but zero collateral that cannot be liquidatedFixed
The report gives no description here.
MediumHyperLend close position offsets flash loan by existing USDT balance but does not use it for repayment, leaving an inflated slippage window on the collateral swapFixed
The report gives no description here.
MediumMinimum position size not enforced after repayment allowing creation of dust positions that pollute sorted list and escape liquidationFixed
The report gives no description here.
MediumOracle staleness and price-bound reverts DoS liquidation and redemption during market stressFixed
The report gives no description here.
Show 10 more
MediumRemaining Collateral Returned to Liquidated Borrower Instead of Being RedistributedFixed
The report gives no description here.
MediumSame Borrower Can Be Redeemed Multiple Times in a Single Fallback Redemption PassFixed
The report gives no description here.
MediumSorted Debt List Becomes Stale Due to Price Changes and Interest AccrualFixed
The report gives no description here.
MediumSorted debt list not updated after collateral deposit allowing unfair targeting in fallback redemptions and liquidationsFixed
The report gives no description here.
MediumUnbounded O(n) traversal in sorted debt updates forces user operations off HyperEVM small blocks and breaks fallback flows at low borrower countsFixed
The report gives no description here.
MediumUnlimited credit delegation and aToken approval to an unverified external HyperLoop contractFixed
The report gives no description here.
LowBorrow index rounds down while per-user interest rounds up, creating inconsistent and nonstandard rounding policyFixed
The report gives no description here.
LowBuffer can be drained cheaply via a deposit-then-withdraw cycleFixed
The report gives no description here.
LowDefault oracle staleness age is too low for Chainlink push feedsFixed
The report gives no description here.
LowDelphoStabilityPool cannot stake USDV already held in its own balanceFixed
The report gives no description here.
Show 10 more
LowDelphoStableManager initialize does not emit BorrowDetailsUpdatedFixed
The report gives no description here.
LowDelphoStableManager.validateLTV returns stale results because it does not accrue pending interestFixed
The report gives no description here.
LowDisabling a token traps its executor-deployed principal inside the executor and blocks admin from rebalancing it back to usersFixed
The report gives no description here.
LowHyperLend executor cannot close position when executor already holds enough USDT to cover the debtFixed
The report gives no description here.
LowHyperLend executor's flash loan premium calculation rounds down and hardcodes 5 bpsFixed
The report gives no description here.
LowIncorrect storage-gap comments and reserve totals in oracle/token config modulesFixed
The report gives no description here.
LowLiquidator fee cap is too high given the liquidator provides no capitalFixed
The report gives no description here.
LowNew errors missing NatSpec and an unused error declarationFixed
The report gives no description here.
LowProportional Interest Reduction May Leave Non-Zero Interest on a Fully Seized PositionFixed
The report gives no description here.
LowproportionBps Rounding to Zero Allows SP to Absorb Debt With No Liquidation PenaltyFixed
The report gives no description here.
Show 10 more
LowRe-leverage mint undershoots targetBps due to mixed rounding on LTV vs mint sizeFixed
The report gives no description here.
LowRedemption peg defense becomes ineffective under stress because the shared 5% buffer empties quickly and remaining capital is locked in executor positionsFixed
The report gives no description here.
LowRedundant Exclusion Checks in _distribute-FallbackDebt LoopFixed
The report gives no description here.
LowRedundant interest accrual writes when borrow index delta is zero waste gas in multi-step flowsFixed
The report gives no description here.
LowsetEpochDuration Does Not Advance the Epoch Before Changing DurationFixed
The report gives no description here.
LowShort leg sizing uses inconsistent rounding between HyperLend and Morpho executorsFixed
The report gives no description here.
LowShortfall Calculation Records Interest Portion of Absorbed Debt as Bad DebtFixed
The report gives no description here.
LowStability Pool redemption seizes collateral greedily token-by-token while the fallback path seizes proportionallyFixed
The report gives no description here.
LowUnbounded loop in _cancelExcessPendingWithdrawals can grief liquidation and fallback redemptionFixed
The report gives no description here.
LowUSDV sent directly to the DelphoStaker contract is permanently lockedFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Delpho’s security record
DelphoSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us