Skip to content
Request an audit

‹ All findings

BlueBundlesV1::blueBundlesV1RepayAndWithdrawCollateral() may transfer a null leftover

Low/InfoMorpho Midnight Bundles·Blackthorn · Lending · 14th July, 2026CodebaseI-1

ReportSource

Summary

The leftover transfer in BlueBundlesV1::blueBundlesV1RepayAndWithdrawCollateral() is not skipped when null, unlike the referral fee transfer above it (and on the rest of the codebase).

Vulnerability Detail

maxRepayAssets - repayAssets - referralFeeAssets is 0 whenever maxRepayAssets exactly covers the repaid assets plus the fee, which is the natural sizing on an exact assets repay with a null referral fee (maxRepayAssets == repayAssets).

Impact

Tokens reverting on 0 transfer are not supported, so the only impact is consistency throughout the codebase.

Code Snippet

BlueBundlesV1.sol#L118-L120

solidity
SafeTransferLib.safeTransfer(
    marketParams.loanToken, msg.sender, maxRepayAssets - repayAssets - referralFeeAssets
);

Tool Used

Manual Review

Recommendation

Skip the transfer when the amount is null, consistent with the rest of the codebase.