Skip to content
Request an audit

‹ All findings

proof.length can be used instead ofheight in EcrecoverRatifier.isRatified

Low/InfoMorpho Midnight·Blackthorn · Lending · 6th April, 2026CodebaseL-4

ReportSource

Summary

EcrecoverRatifier.isRatified decodes height from the ratifier data and folds it into the EIP-712 typehash. For every tree the protocol accepts under OfferTree(Offer[2]...[2] offerTree), so height is always equal to proof.length.

Detail

HashLib.offerTreeTypeHash only returns typehashes for Offer[2]^height balanced binary trees, so the height is the length of the proof.

Impact

Optimization

Code Snippet

https://github.com/sherlock-audit/2026-04-morpho-midnight-apr-6th-2026/blob/main/morpho-org__midnight/src/ratifiers/EcrecoverRatifier.sol#L36-L40

solidity
(Signature memory sig, uint256 height, bytes32 root, bytes32[] memory proof) =
    abi.decode(ratifierData, (Signature, uint256, bytes32, bytes32[]));
require(HashLib.isLeaf(root, HashLib.hashOffer(offer), proof), InvalidProof());
require(!isRootCanceled[offer.maker][root], RootCanceled());
bytes32 structHash = keccak256(abi.encode(HashLib.offerTreeTypeHash(height), root));

Tool Used

Manual Review

Recommendation

Use proof.length instead of height.