Sherlock security record
As of 3 Nov 2026, Sherlock has 1 audit report on Trustblock, by Quantstamp, dated 10 Aug 2021. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Sherlock | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings25
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 4 | 1 |
| Low | 3 | 12 | 4 |
LowGas ConcernsSherlock · Quantstamp · 10 Aug 2021Open
The following smart contract functions contain loops and could lead to an out-of-gas error if the number of supported ERC20 tokens and/or protocols by Sherlock is too large: 1. `Gov.protocolRemove` loops over the number of ERC20 tokens underlying SHERX. 2. `Payout._doSherX` loops over the number of ERC20 tokens underlying SHERX. 3. `SherX.calcUnderlyingInStoredUSD` loops over the number of ERC20 tokens underlying SHERX. 4. `SherX.harvestFor` loops over the number of ERC20 tokens stakers are allowed to stake in. 5. `SherX.setInitialWeight` loops over the number of ERC20 tokens stakers are allowed to stake in. 6. `SherX.redeem` loops over the number of ERC20 tokens stakers are allowed to stake in. 7. `LibPool.payOffDebtAll` loops over the number of protocols registered in the corresponding pool. 8. `LibSherX.calcUnderlying` loops over the number of ERC20 tokens underlying SHERX. 9. `LibSherX.accrueSherX` loops over the number of ERC20 tokens stakers are allowed to stake in. 10. `Manager.setProtocolPremium` loops over many protocols and tokens. In particular, because is a double loop, the inner call to `LibPool.payOffDebtAll(_token[i][j]);` may be invoked many times for the same token. Note that these are not the only functions with loops. There is a large number of functions with loops in the code base, where the loop boundary is given by the length of one of the input arrays to the corresponding function. Since those functions are external functions we assume that the caller will be notified by their wallet software in case the length of the input array is too large. However, all functions with loops should be in scope for this issue.
Open the reportLowIgnored Return ValuesSherlock · Quantstamp · 10 Aug 2021Open
The `AaveV2.withdrawAll` and `AaveV2.withdraw` functions call the Aave lending pool `withdraw` function which returns the final amount withdrawn. Since this is an external contract and we have seen several past attacks where the vulnerable code has made implicit assumptions on calls to external contracts without explicitly checking them, we believe that this poses a risk in case the amount withdrawn from Aave would be much lower than the expected amount.
Open the reportLowUnlocked DependenciesSherlock · Quantstamp · 10 Aug 2021Open
All dependency versions inside `package.json` are unlocked due to `^` before the version number. Moreover, the core dependency, namely the [`diamond-2` repo](https://github.com/mudgen/diamond-2) is specified without any version number, which means that the latest commit from the `master` branch will be used when calling `yarn install`. Such a commit might be insecure or unstable since it is not necessarily a release commit.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="sherlock"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us