Delpho security record
As of 10 Nov 2026, Delpho has 1 audit report on Trustblock, by Sherlock, dated 8 Sep 2026. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits2
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| Delpho audit | Security firm: Sherlock | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Delpho audit | Security firm: Sherlock | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
Findings56
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 16 |
| Low | 0 | 7 | 29 |
HighRegistered-but-disabled collateral is dropped by the config replay, freezing every position that holds itDelpho audit · Sherlock · 8 Sep 2026Fixed
The report gives no description here.
Open the reportHighAccrued interest is silently destroyed during fallback redemption instead of being paid to the fee receiverDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportHighAccrued interest is silently destroyed during liquidation instead of being paid to the fee receiverDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportHighHyperLend Rewards Controller Rewards Are Never Claimed or ForwardedDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumPSM min single redemption strands dustDelpho audit · Sherlock · 8 Sep 2026Fixed
The report gives no description here.
Open the reportMediumPSM mints and redeems USDV against USDC at a hardcoded 1:1 with no oracle, so a USDC depeg directly under-backs USDVDelpho audit · Sherlock · 8 Sep 2026Fixed
The report gives no description here.
Open the reportMediumV2 applies isTokenSupported on withdrawal paths, so disabling a collateral permanently locks it in the WHYPE/KHYPE marketDelpho audit · Sherlock · 8 Sep 2026Fixed
The report gives no description here.
Open the reportMediumChainlink feed parameters cannot be safely updated after token registrationDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumDelphoStaker reward distribution can be frontrun to steal yield from existing stakersDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumDisabling a collateral token reverts price reads and blocks liquidation and withdrawal of existing holdersDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportShow 10 more
MediumFallback redemption against an underwater borrower can create a stuck active position with debt but zero collateral that cannot be liquidatedDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumHyperLend close position offsets flash loan by existing USDT balance but does not use it for repayment, leaving an inflated slippage window on the collateral swapDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumMinimum position size not enforced after repayment allowing creation of dust positions that pollute sorted list and escape liquidationDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumOracle staleness and price-bound reverts DoS liquidation and redemption during market stressDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumRemaining Collateral Returned to Liquidated Borrower Instead of Being RedistributedDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumSame Borrower Can Be Redeemed Multiple Times in a Single Fallback Redemption PassDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumSorted Debt List Becomes Stale Due to Price Changes and Interest AccrualDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumSorted debt list not updated after collateral deposit allowing unfair targeting in fallback redemptions and liquidationsDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumUnbounded O(n) traversal in sorted debt updates forces user operations off HyperEVM small blocks and breaks fallback flows at low borrower countsDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportMediumUnlimited credit delegation and aToken approval to an unverified external HyperLoop contractDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowA system address must never be configured for USDC, because both plausible values silently destroy fundsDelpho audit · Sherlock · 8 Sep 2026Fixed
The report gives no description here.
Open the reportLowDelphoRouterV2 re-implements six V1 functions that are already reusable, four needing only a visibility change and two needing nothing at allDelpho audit · Sherlock · 8 Sep 2026Fixed
The report gives no description here.
Open the reportLowPSM documented USDT but unsupportedDelpho audit · Sherlock · 8 Sep 2026Fixed
The report gives no description here.
Open the reportLowPSM mint does not open redemption windowDelpho audit · Sherlock · 8 Sep 2026Fixed
The report gives no description here.
Open the reportLowWHYPE PM executor is granted the systemwide HANDLER_ROLE where no existing role is correctly scopedDelpho audit · Sherlock · 8 Sep 2026Fixed
The report gives no description here.
Open the reportLowBorrow index rounds down while per-user interest rounds up, creating inconsistent and nonstandard rounding policyDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowBuffer can be drained cheaply via a deposit-then-withdraw cycleDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowDefault oracle staleness age is too low for Chainlink push feedsDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowDelphoStabilityPool cannot stake USDV already held in its own balanceDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowDelphoStableManager initialize does not emit BorrowDetailsUpdatedDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowDelphoStableManager.validateLTV returns stale results because it does not accrue pending interestDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowDisabling a token traps its executor-deployed principal inside the executor and blocks admin from rebalancing it back to usersDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowHyperLend executor cannot close position when executor already holds enough USDT to cover the debtDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowHyperLend executor's flash loan premium calculation rounds down and hardcodes 5 bpsDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowIncorrect storage-gap comments and reserve totals in oracle/token config modulesDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowLiquidator fee cap is too high given the liquidator provides no capitalDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowNew errors missing NatSpec and an unused error declarationDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowProportional Interest Reduction May Leave Non-Zero Interest on a Fully Seized PositionDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowproportionBps Rounding to Zero Allows SP to Absorb Debt With No Liquidation PenaltyDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowRe-leverage mint undershoots targetBps due to mixed rounding on LTV vs mint sizeDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportShow 9 more
LowRedemption peg defense becomes ineffective under stress because the shared 5% buffer empties quickly and remaining capital is locked in executor positionsDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowRedundant Exclusion Checks in _distribute-FallbackDebt LoopDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowRedundant interest accrual writes when borrow index delta is zero waste gas in multi-step flowsDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowsetEpochDuration Does Not Advance the Epoch Before Changing DurationDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowShort leg sizing uses inconsistent rounding between HyperLend and Morpho executorsDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowShortfall Calculation Records Interest Portion of Absorbed Debt as Bad DebtDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowStability Pool redemption seizes collateral greedily token-by-token while the fallback path seizes proportionallyDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowUnbounded loop in _cancelExcessPendingWithdrawals can grief liquidation and fallback redemptionDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportLowUSDV sent directly to the DelphoStaker contract is permanently lockedDelpho audit · Sherlock · 22 Apr 2026Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="delpho"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us