Delpho audit
Audit · firm’s term: collaborative audit
Sherlock reviewed Delpho (Delpho audit) on 8 Sep 2026: 12 findings, 0 critical; 9 marked fixed, 3 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings12
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 3 | 5 |
HighRegistered-but-disabled collateral is dropped by the config replay, freezing every position that holds itFixed
The report gives no description here.
MediumPSM min single redemption strands dustFixed
The report gives no description here.
MediumPSM mints and redeems USDV against USDC at a hardcoded 1:1 with no oracle, so a USDC depeg directly under-backs USDVFixed
The report gives no description here.
MediumV2 applies isTokenSupported on withdrawal paths, so disabling a collateral permanently locks it in the WHYPE/KHYPE marketFixed
The report gives no description here.
LowA system address must never be configured for USDC, because both plausible values silently destroy fundsFixed
The report gives no description here.
LowDelphoRouterV2 re-implements six V1 functions that are already reusable, four needing only a visibility change and two needing nothing at allFixed
The report gives no description here.
LowPSM documented USDT but unsupportedFixed
The report gives no description here.
LowPSM mint does not open redemption windowFixed
The report gives no description here.
LowWHYPE PM executor is granted the systemwide HANDLER_ROLE where no existing role is correctly scopedFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Delpho’s security record
DelphoSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us