Morpho: Midnight - BlueBuyCallback [93db7e08]
Cantina reviewed Morpho (Morpho: Midnight - BlueBuyCallback [93db7e08]) on 3 Aug 2026: 3 findings, 0 critical; 1 marked fixed, 2 acknowledged.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings3
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 2 | 1 |
Marked Informational by the firm. Not counted as findings.
InformationalBlueBuyCallbackFactory should revert when incorrectly configuredAcknowledged
The report gives no description here.
InformationalConsider reducing the complexity of BlueBuyCallback flows derived by unrestricted delegation on Blue positionsAcknowledged
The report gives no description here.
InformationalExecute allowance approval only when tokens will be actually pulled by MidnightAcknowledged
The report gives no description here.
InformationalOffers in midnight using BlueBuyCallback can be forced to revert by draining Morpho Blue liquidityAcknowledged
The report gives no description here.
InformationalsetAuthorization and setAuthorizationWithSig should not allow the OWNER to remove self-unauthorizeAcknowledged
The report gives no description here.
InformationalBlueBuyCallback lacks a skim endpoint for stranded assetsFixed
The report gives no description here.
InformationalBlueBuyCallback natspec should be further expandedFixed
The report gives no description here.
InformationalBlueBuyCallbackFactory.createBlueBuyCallback should track the msg.senderFixed
The report gives no description here.
InformationalbuyerAssetsBound should document if the callback contract can be configured as a BLUE fee recipientFixed
The report gives no description here.
InformationalConsider documenting the token assumptions made by safeApproveFixed
The report gives no description here.
Show 2 more
InformationalConsider using on demand exact allowance approval when onBuy is executedFixed
The report gives no description here.
InformationalcreateBlueBuyCallback() reverts if an owner already has BlueBuyCallback deployedFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Morpho’s security record
MorphoSecurity firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us