Sherpa security record
As of 14 Oct 2026, Sherpa has 1 audit report on Trustblock, by Cyfrin, dated 23 Nov 2025. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Sherpa Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
Findings13
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 0 | 10 |
MediumOwner can chain admin calls for same-block drainsSherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportMediumOwner can rescue the vault’s own share tokensSherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportMediumWithdrawals can effectively only happen on the primary chain after any yield has accruedSherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportLowCCIPReceiver dependency not necessarySherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportLowConsider implementing explicit rounding behaviour instead of default round downSherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportLowDirect amount assignment in SherpaUSD::ownerMint/ownerBurn can break accounting for totalStaked and accountingSupplySherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportLowMisconfigured decimal scale can skew vault accountingSherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportLowOptimize setters by emitting event before state updatesSherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportLowSherpaUSD does not work with fee-on-transfer tokensSherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportLowSherpaUSD::consumeTotalStakedApproval and SherpaUSD::consumeAccountingApproval callable by anyoneSherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportShow 3 more
LowSherpaVault::_rollInternal price calculation comment and math inconsistentSherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportLowSherpaVault::redeem naming ambiguousSherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportLowSome SherpaUSD can never be unstaked due to minimumSupply checkSherpa Audit Report · Cyfrin · 23 Nov 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="sherpa"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us