Mellow security record
As of 31 Oct 2026, Mellow has 5 audit reports by 2 security firms on Trustblock; the latest is by Nethermind Security, dated 19 Nov 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits5
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Mellow Finance security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Mellow Finance security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Mellow security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Multivault Smart Contracts | Security firm: ChainSecurity | Date: | Scope: Repository at commit 764c15a | No open critical findings | Open · chainsecurity.com |
| Symbiotic Security Vault | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
Findings36
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 4 |
| Medium | 0 | 1 | 8 |
| Low | 1 | 5 | 17 |
HighInconsistent Price Conversion Logic Leads to Incorrect Oracle PricesMellow security review · Nethermind Security · 3 Sep 2025Fixed
The report gives no description here.
Open the reportHighOff-chain price calculation can result in an infinite loopMellow security review · Nethermind Security · 3 Sep 2025Fixed
The report gives no description here.
Open the reportHighIncorrect Valuation of ERC-4626Multivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportHighPending Assets Become Claimed During WithdrawalMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumEigenLayer Queue wstETH Mix-UpMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumEscalation of PrivilegesMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumInsufficient Limitations for StrategiesMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumIsolated EigenLayer Vault Not FunctionalMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumOperator Undelegations Are Not Accounted forMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumTransfer Pending Assets Skips AssetsMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportShow 10 more
MediumBroken Queue AccountingSymbiotic Security Vault · ChainSecurity · 24 Jan 2025Fixed
The report gives no description here.
Open the reportMediumWithdrawal Request Claiming ManipulationSymbiotic Security Vault · ChainSecurity · 24 Jan 2025Fixed
The report gives no description here.
Open the reportLowClaimable Assets Are Transferred as PendingMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowDouble Tracking of Withdrawals and Transferred WithdrawalsMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowEigenLayer Not Ready to Be Integrated With Without UpgradesMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowgetOrCreate Never GetsMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowImplicit Minimum Deposit for EigenLayerMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowIncorrect Manager for Pausing Check for EigenLayerMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowIncorrect Maximum Computation in Ratios StrategyMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowIncorrect Maximum Deposit Computation in Ratio StrategyMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportShow 9 more
LowIncorrect Target for ERC-4626 Maximum Deposit QueryMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowOld Vault Contracts Can Not Be Migrated EasilyMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowSending Pending Assets to Yourself Leads to LossesMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowShutdown Does Not Stop DepositsMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowTemporary Vault DoS Due to Shutdown DelayMultivault Smart Contracts · ChainSecurity · 12 May 2025Fixed
The report gives no description here.
Open the reportLowBroken Pending Asset ComputationSymbiotic Security Vault · ChainSecurity · 24 Jan 2025Fixed
The report gives no description here.
Open the reportLowIncorrect Deposit Limit During MigrationSymbiotic Security Vault · ChainSecurity · 24 Jan 2025Fixed
The report gives no description here.
Open the reportLowMigrationSymbiotic Security Vault · ChainSecurity · 24 Jan 2025Fixed
The report gives no description here.
Open the reportLowWhitelisting Might Block Pushing to SymbioticSymbiotic Security Vault · ChainSecurity · 24 Jan 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="mellow-lrt"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us