Delegation Framework Audit Report

Cyfrin18 Mar 2025Code version: not recorded (see the report)

Audit · firm’s term: audit report

Cyfrin reviewed MetaMask (Delegation Framework Audit Report) on 18 Mar 2025: 8 findings, 0 critical; 6 marked fixed, 2 acknowledged.

No open critical findings

Open the report Open MetaMask’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	1	1
Low	0	1	4

Marked Informational or Gas by the firm. Not counted as findings.

InformationalInsufficient delegate address validation in NativeTokenPaymentEnforcerAcknowledged

The report gives no description here.

InformationalNotSelf() error declaration is unusedAcknowledged

The report gives no description here.

GasWebAuthn::contains() optimizationAcknowledged

The report gives no description here.

InformationalDelegationManager is incompatible with smart contract wallets with Approved hashesFixed

The report gives no description here.

InformationalMissing zero length check in AllowedMethodsEnforcer::getTermsInfo()Fixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of MetaMask’s security record

MetaMask

Audits8 audits by 2 firmsLast audit Apr 2026, by Cyfrin.

Critical findingsNo open critical findingsAcross 8 reports.

Open MetaMask’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.