# `proof.length` can be used instead of`height` in `EcrecoverRatifier.isRatified` Low/Info · Blackthorn · Lending · 6th April, 2026 Finding L-4 of the Morpho Midnight security review. - Protocol: https://morpho.org/ - Report: /reports/morpho-midnight - Codebase: https://github.com/0xsimao/midnight/tree/e9085f8c5fe96df6e075847b95b0dd7cea86110d - Source: https://github.com/morpho-org/midnight/blob/main/audits/2026-07-02-blackthorn.pdf --- ## Summary `EcrecoverRatifier.isRatified` decodes `height` from the ratifier data and folds it into the EIP-712 typehash. For every tree the protocol accepts under `OfferTree(Offer[2]...[2] offerTree)`, so `height` is always equal to `proof.length`. ## Detail `HashLib.offerTreeTypeHash` only returns typehashes for `Offer[2]^height` balanced binary trees, so the height is the length of the proof. ## Impact Optimization ## Code Snippet https://github.com/sherlock-audit/2026-04-morpho-midnight-apr-6th-2026/blob/main/morpho-org__midnight/src/ratifiers/EcrecoverRatifier.sol#L36-L40 ```solidity (Signature memory sig, uint256 height, bytes32 root, bytes32[] memory proof) = abi.decode(ratifierData, (Signature, uint256, bytes32, bytes32[])); require(HashLib.isLeaf(root, HashLib.hashOffer(offer), proof), InvalidProof()); require(!isRootCanceled[offer.maker][root], RootCanceled()); bytes32 structHash = keccak256(abi.encode(HashLib.offerTreeTypeHash(height), root)); ``` ## Tool Used Manual Review ## Recommendation Use `proof.length` instead of height.