Rocko Flash Refinance Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed ROCKO (Rocko Flash Refinance Audit Report) on 28 Mar 2025: 2 findings, 0 critical; all marked fixed.
Findings2
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 2 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalConsider allowing update to AAVE_DATA_PROVIDERAcknowledged
The report gives no description here.
GasDon’t initialize to default valuesFixed
The report gives no description here.
InformationalError messages hardcode USDC but other debt tokens may be usedFixed
The report gives no description here.
InformationalEvents missing indexed parametersFixed
The report gives no description here.
InformationalIn _withdrawAaveCollateral fetch aTokenAddress from Aave instead of receiving as input in refinance as passing it to morpho and back againFixed
The report gives no description here.
InformationalInconsistent implementation approach for retrieving collateral balance from MorphoFixed
The report gives no description here.
InformationalInsufficient data length validation in onMorphoFlashLoanFixed
The report gives no description here.
GasPrevent repetitive hashing of identical stringsFixed
The report gives no description here.
InformationalProvide a way for users to revoke all approvalsFixed
The report gives no description here.
GasRedundant collateral balance check in _openLoanMorphoFixed
The report gives no description here.
Show 7 more
GasRemove obsolete check in updateFeeFixed
The report gives no description here.
GasRemove redundant morphoMarketId validation checks in _closeLoan- MorphoWithShares and _openLoanPositionFixed
The report gives no description here.
GasRemove redundant onBehalfOf variablesFixed
The report gives no description here.
InformationalUnnecessary event emission when configuration values do not changeFixed
The report gives no description here.
GasUse msg.sender instead of owner() inside onlyOwner functionsFixed
The report gives no description here.
GasUse named return variables to eliminate redundant local variables and return statementsFixed
The report gives no description here.
GasUse ReentrancyGuardTransient instead of ReentrancyGuard or more gas-efficient nonReentrant modifiersFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of ROCKO’s security record
Security firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us