Delegation Framework Audit Report

CyfrinCode version: not recorded (see the report)

Audit · firm’s term: audit report

Cyfrin reviewed MetaMask (Delegation Framework Audit Report) on 18 Mar 2025: 8 findings, 0 critical; 6 marked fixed, 2 acknowledged.

No open critical findings
Open the reportOpen MetaMask’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium011
Low014
HighEntryPoint not included in user operation hash creates the possibility of Replay AttacksFixed

The report gives no description here.

MediumTransfer Amount enforcer for ERC20 and Native transfers increase spend limit without checking actual transfersFixed

The report gives no description here.

LowAllowedCalldataEnforcer cannot authenticate empty calldata preventing receive() function callsFixed

The report gives no description here.

LowEIP7702StatelessDeleGator violates EIP4337 signature validation standardsFixed

The report gives no description here.

LowNFT safe transfers will revert using ERC721TransferEnforcerFixed

The report gives no description here.

LowParameter mismatch in IdEnforcer::beforeHook() event emissionFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of MetaMask’s security record

MetaMask
Audits8 audits by 2 firmsLast audit Apr 2026, by Cyfrin.
Critical findingsNo open critical findingsAcross 8 reports.
Open MetaMask’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us