# Adapters could store the index instead of true in the `VaultV2` to remove the O(n) search Low/Info · Blackthorn · Curated yield vaults · 13th August, 2025 Finding L-3 of the Morpho Vault V2 security review. - Protocol: https://morpho.org/ - Report: /reports/morpho-vault-v2 - Codebase: https://github.com/0xsimao/vault-v2/tree/ce661d820fb29307981f75eb42393db1c6e42758 - Source: https://github.com/morpho-org/vault-v2/blob/main/audits/2025-09-15-blackthorn.pdf --- ## Summary `VaultV2::setIsAdapter()` removes the adapter from the array by doing a O(n) search, which is ineffective. ## Vulnerability Detail The number of adapters is admin controlled so DoS should never happen due to OOG. However, it could not even be a concern in case the index of the adapter plus one (1) was stored in the mapping, such that no search was needed. ## Impact Gas optimization and better security guarantees. ## Code Snippet https://github.com/sherlock-audit/2025-08-morpho-vault-v2-aug-13th/pull/25/files#diff-b9b86210e027003894f79227889d79167f92c0aa2b2a1b0291f4606002e22540R355 ## Tool Used Manual Review ## Recommendation Store the index plus one (1) in the mapping instead and use it to remove from the array. --- Related findings: - [ConnextHandler can store the hash of the failed messages instead](https://0xsimao.com/findings/fuji-finance-handler-store-hash-messages): Fuji Finance - [`VaultPoolLib::reserve()` will store the `Pa` not attributed to user withdrawals incorrectly and leave in untracked once it expires again](https://0xsimao.com/findings/cork-protocol-attributed-withdrawals-untracked-expires): Cork Protocol - [Use a flag to increase or decrease the index of the pool instead of a heuristic](https://0xsimao.com/findings/nftperp-ii-flag-decrease-index-heuristic): Nftperp Matching Engine