MetaMask security record

Ethereum, Polygon (POS), Arbitrum, Optimism, Basemetamask.io X GitHub

As of 29 Sep 2026, Trustblock’s record for MetaMask holds 8 audit reports by 2 audit firms (Oct 2024 to Apr 2026). The latest audit is “MetaMask VedaAdapter Audit Report” by Cyfrin, dated 20 Apr 2026. Those reports list no open critical findings.

Critical findings

No open critical findings

Across 8 reports.

Open the latest report Get the label for your site

Record last updated 29 Sep 2026. It holds audits, findings and contracts up to Oct 2026, and incidents up to Sep 2026. Statuses are the audit firms’ own. Trustblock does not review code.

Audits: 8; by 2 firms, Oct 2024 to Apr 2026
Last audit: 20 Apr 2026; by Cyfrin
Audit firms: 2; Cyfrin and Consensys

Issues (55)

	Low	Medium	High	Critical	Total
Not fixed	2	-	-	-	2
Acknowledged	10	5	-	-	15
Fixed	29	6	3	-	38
Total	41	11	3	0	55

Audits (8)

#	Name	Auditor	Date	Chains	Issues
1	MetaMask VedaAdapter Audit Report	Cyfrin	2026/04/20	Multi-Chain	No open critical findings
2	MetaMask Connect Audit Report	Cyfrin	2026/03/05	Multi-Chain	No open critical findings
3	Delegation Framework - Total Balance Change	Cyfrin	2025/09/01	Multi-Chain	No open critical findings
4	Metamask Delegation Framework Audit Report	Cyfrin	2025/05/07	Multi-Chain	No open critical findings
5	Metamask Delegation Framework Audit Report	Cyfrin	2025/05/01	Multi-Chain	No open critical findings
6	Delegation Framework Audit Report	Cyfrin	2025/04/01	Multi-Chain	No open critical findings
7	Delegation Framework Audit Report	Cyfrin	2025/03/18	Multi-Chain	No open critical findings
8	MetaMask Delegation Framework	Consensys	2024/10/01	Multi-Chain	No open critical findings

Contracts (15)

#	Github Repository	Commit Hash	File	Url
1	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/enforcers/ERC1155BalanceGteEnforcer.sol	Check on Github
2	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/enforcers/OwnershipTransferEnforcer.sol	Check on Github
3	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/DeleGatorCore.sol	Check on Github
4	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/DelegationManager.sol	Check on Github
5	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/HybridDeleGator.sol	Check on Github
6	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/libraries/WebAuthn.sol	Check on Github
7	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/enforcers/ERC721TransferEnforcer.sol	Check on Github
8	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/enforcers/ERC721BalanceGteEnforcer.sol	Check on Github
9	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/libraries/P256VerifierLib.sol	Check on Github
10	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/interfaces/ICaveatEnforcer.sol	Check on Github

Get your label

Is this your project? Add a free label to your website. It shows the audits published on Trustblock, with the latest firm and date, and links to this page. It updates by itself.

HTML

<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
<div
  data-tb-project-widget
  data-tb-project-slug="metamask"
  data-tb-variant="label"
  data-tb-color="light"
></div>

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us

#	Github Repository	Commit Hash	File	Url
1	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/enforcers/ERC1155BalanceGteEnforcer.sol	Check on Github
2	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/enforcers/OwnershipTransferEnforcer.sol	Check on Github
3	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/DeleGatorCore.sol	Check on Github
4	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/DelegationManager.sol	Check on Github
5	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/HybridDeleGator.sol	Check on Github
6	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/libraries/WebAuthn.sol	Check on Github
7	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/enforcers/ERC721TransferEnforcer.sol	Check on Github
8	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/enforcers/ERC721BalanceGteEnforcer.sol	Check on Github
9	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/libraries/P256VerifierLib.sol	Check on Github
10	MetaMask/delegation-framework	ec0c0d64a4fc1ccca24d5e910d5712e62d84c4b7	src/interfaces/ICaveatEnforcer.sol	Check on Github

MetaMask security record

Issues (55)

Front-runner can override withdrawal token and slippage parameters in permissionless VedaAdapter functionsnot_fixed/low

Potential Misuse of ERC1155BalanceGteEnforcer and ERC721BalanceGteEnforcer.not_fixed/low

Deployment script instructs using plaintext private key via CLI argumentAcknowledgedacknowledged/low

Public batch execution is economically griefable because a single pre-consumed delegation reverts the entire batchAcknowledgedacknowledged/low

VedaAdapter acts as a shared msg.sender for all Teller withdrawals, allowing any entity authorized for the TellerWithMultiAssetSupport::deposit to lock the adapter and block all user withdrawalsAcknowledgedacknowledged/low

Audits (8)

Contracts (15)

Get your label

Audits (8)