Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Hyperbeat Pay>Design>Component: MorphoService
GeneralOverview
Findings
Critical (1)
Medium (3)
Low (7)
Informational (1)
Indeterminate (2)
DiscussionIncompatible with nonstandard ERC-20 tokensWithdrawal-fee bypass with dust amountsMissing token whitelist validation in ACTION_CUSTOM pathTest suite
DesignComponent: ManagementAccountComponent: ManagementAccountFactoryComponent: ServiceRegistryComponent: TokenWhitelistRegistryComponent: MorphoService
Audit ResultsAssessment Results

Component: MorphoService

Description

The MorphoService is a service adapter contract that enables ManagementAccounts to interact with the Morpho lending protocol. It constructs Morpho-specific call payloads that ManagementAccounts can execute.

Invariants

Market registration integrity

  • Only the service owner can register markets.

  • Once registered, market parameters stored in marketParamsById cannot be modified.

Asset verification

  • When building action calldata for a collateral asset, the function verifies that the market for that collateral asset is already registered.

  • When building action calldata for a loan asset, the function verifies that the market for that loan asset is already registered.

Authorization integrity

  • Only the MORPHO_AUTHORIZATION type is supported for authorization operations.

  • Morpho authorization for the operator is binary (granted or revoked) and does not support granular amounts.

Attack surface

  • The asset input validation. The asset parameter in build functions is validated by verifying it maps to a registered market. Unregistered assets cause transactions to revert, preventing interaction with unsupported tokens.

Zellic © 2025Back to top ↑