public-allocator
Cantina reviewed Morpho (public-allocator) on 10 May 2024: 5 findings, 0 critical; 2 marked fixed, 3 acknowledged.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings5
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 0 | 2 | 2 |
Marked Informational by the firm. Not counted as findings.
InformationalConsider adding a pausable feature to reallocateTo is triggerable only by one of Morpho's guardiansAcknowledged
The report gives no description here.
InformationalConsider renaming allocator config variables and functions to be more vault specificAcknowledged
The report gives no description here.
InformationalConsider tracking the msg.sender in the event emitted by the PublicAllocator contractFixed
The report gives no description here.
InformationalMore event parameters can be declared as indexedFixed
The report gives no description here.
InformationalNatSpec documentation issues: missed parameters, typos or suggested updatesFixed
The report gives no description here.
InformationalPublicReallocateTo event is emitted with the wrong parameters orderFixed
The report gives no description here.
InformationalVault's flow caps should be constrained by the vault's state and configurationFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Morpho’s security record
MorphoSecurity firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us