# `BlueBundlesV1::blueBundlesV1RepayAndWithdrawCollateral()` may transfer a null leftover Low/Info · Blackthorn · Lending · 14th July, 2026 Finding I-1 of the Morpho Midnight Bundles security review. - Protocol: https://morpho.org/ - Report: /reports/morpho-blue-bundles - Codebase: https://github.com/0xsimao/bundles/tree/713af6ddfa64270c4ac8689532f05306a8ac72ea - Source: https://github.com/morpho-org/bundles/blob/main/audits/2026-07-06-blackthorn.pdf --- ## Summary The leftover transfer in `BlueBundlesV1::blueBundlesV1RepayAndWithdrawCollateral()` is not skipped when null, unlike the referral fee transfer above it (and on the rest of the codebase). ## Vulnerability Detail `maxRepayAssets - repayAssets - referralFeeAssets` is 0 whenever `maxRepayAssets` exactly covers the repaid assets plus the fee, which is the natural sizing on an exact assets repay with a null referral fee (`maxRepayAssets == repayAssets`). ## Impact Tokens reverting on 0 transfer are not supported, so the only impact is consistency throughout the codebase. ## Code Snippet [BlueBundlesV1.sol#L118-L120](https://github.com/sherlock-audit/2026-07-morpho-blue-bundles-july-13th-2026/blob/main/morpho-org__bundles/src/blue/BlueBundlesV1.sol#L118-L120) ```solidity SafeTransferLib.safeTransfer( marketParams.loanToken, msg.sender, maxRepayAssets - repayAssets - referralFeeAssets ); ``` ## Tool Used Manual Review ## Recommendation Skip the transfer when the amount is null, consistent with the rest of the codebase. --- Related findings: - [`GlobalVariables::oftOrCollateralReceiveFromOtherChains()` always charges twice the collateral on `COLLATERAL_TRANSFER`, which is not needed](https://0xsimao.com/findings/autonomint-collateral-charges-transfer-needed): Autonomint - [It's possible to borrow, redeem, transfer tokens and exit markets with outdated collateral prices and borrow interest](https://0xsimao.com/findings/venus-protocol-isolated-pools-borrow-redeem-collateral-interest): Venus Protocol Isolated Pools - [Halted withdrawals in BatchOut:withdrawFulfill() due to tokens transfer() reverting on 0 transfer amount](https://0xsimao.com/findings/clip-finance-i-halted-withdrawals-withdraw-transfer): Clip Finance Strategies