dHEDGE audit
Audit competition · firm’s term: private contest
Sherlock reviewed dHEDGE (dHEDGE audit) on 22 Jun 2024: 28 findings, 0 critical; 22 marked fixed, 6 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings28
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 9 |
| Medium | 0 | 6 | 13 |
| Low | 0 | 0 | 0 |
HighAerodromeCLGaugeContractGuard allows the manager to drain the Vault by withdrawing liquidity from a Velodrome Gauge and receiving unsupported tokensFixed
The report gives no description here.
HighFunction clipperSwap allows managers to steal all fundsFixed
The report gives no description here.
HighInteger underflow will cause a DoS on new deposits and withdrawalsFixed
The report gives no description here.
HighManager can drain a Vault through reentrancy calling AggregationRouterV6::swapFixed
The report gives no description here.
HighManager can make the Vault's position in Aave liquidatable, stealing funds from usersFixed
The report gives no description here.
HighOneInchV6Guard insufficient checks allow manager to steal tokens via unoswap swapsFixed
The report gives no description here.
HighProtocol manager can steal all funds via reentrancy during the 1inch swap.Fixed
The report gives no description here.
HighThe manager can steal the rewards from all Velodrome GaugesFixed
The report gives no description here.
HighVelodrome staked position are significantly overvaluedFixed
The report gives no description here.
MediumA manager benefits immediately when there is an entry fee.Fixed
The report gives no description here.
Show 10 more
MediumFirst depositor can effectively disable the performance feeFixed
The report gives no description here.
MediumlastFeeMintTime is updated even when streamingFee is zero leading to manager fee lossesFixed
The report gives no description here.
MediumManager can remove the Aave Lending Pool asset to later disrupt the Vault token priceFixed
The report gives no description here.
MediumManagers can deposit NFTs worth nothing while still minting sharesFixed
The report gives no description here.
MediumPerfomance fee is calculated incorrectlyFixed
The report gives no description here.
MediumPrecision loss at AaveLendingPoolAssetGuard will cause a DoS on withdrawalsFixed
The report gives no description here.
MediumPrivate vaults don't prevent non-whitelisted users from investingFixed
The report gives no description here.
MediumThe fee charged on new deposits is calculated incorrectlyFixed
The report gives no description here.
MediumtokenPriceAtLastFeeMint is not resetted to 1e18 when if the pool reaches 0 sharesFixed
The report gives no description here.
MediumVelodromeCLPriceLibrary::assertFairPrice() can revert if oracles with a deviation threshold bigger than 0.3% are usedFixed
The report gives no description here.
Show 2 more
MediumVelodromeCLPriceLibrary::calculateSqrtPrice() can revert for pools in legitimate statesFixed
The report gives no description here.
MediumWithdrawals will revert when a pool contains a velodrome NFT staked in a killed gaugeFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of dHEDGE’s security record
dHEDGESecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us