bundler-v3
Cantina reviewed Morpho (bundler-v3) on 2 Jan 2025: 4 findings, 0 critical; 3 marked fixed, 1 acknowledged.
No open critical findings
Open the reportOpen Morpho’s security record
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings4
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 1 | 2 |
MediumGeneralAdapter1.morphoRepay() incorrectly fetches the borrowShares of initiator instead of onBehalfFixed
The report gives no description here.
LowLack of onlyBundler modifier inside functions of ParaswapAdapter adapter allows stealing fundsFixed
The report gives no description here.
LownativeTransfer() and erc20Transfer() cannot be used to skim remaining balances due to zero amount checkFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Morpho’s security record
MorphoAudits20 audits by 3 firmsLast audit Sep 2026, by Cantina.
Critical findingsNo open critical findingsAcross 20 reports.
Open Morpho’s security recordSecurity firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us