Morpho: VaultV2 + MorphoVaultV1Adapter
Cantina reviewed Morpho (Morpho: VaultV2 + MorphoVaultV1Adapter) on 21 Sep 2026: 9 findings, 0 critical; all acknowledged, none fixed.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 4 | 0 |
| Low | 0 | 5 | 0 |
MediumChecks missing to make sure the exact number of assets withdrawn from deallocationAcknowledged
The report gives no description here.
MediumPerform atomic approvals and add checks when depositing assets into the yield sourceAcknowledged
The report gives no description here.
MediumSlippage protection is missing from adapter deallocate (and allocate endpoint)Acknowledged
The report gives no description here.
MediumThe adapter does not revert on allocate if the newAllocation is 0Acknowledged
The report gives no description here.
LowFaulty ERC4626 yield sources can gradually drain idle or adapter-allocated liquidityAcknowledged
The report gives no description here.
LowIndirect shares donation to adapter may drift accountingAcknowledged
The report gives no description here.
LowSkim can't be used to withdraw rewards which require authenticationAcknowledged
The report gives no description here.
LowTemporary DoS of a VaultV2 by a general ERC4626 yield sourceAcknowledged
The report gives no description here.
LowUnsafe type casts might not be safe for a general ERC4626 VaultAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Morpho’s security record
MorphoSecurity firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us