Skip to content
Request an audit

‹ All findings

VaultV2::withdraw/redeem() are vulnerable to slippage, so another function could be added to protect users

MediumMorpho Vault V2·Blackthorn · Curated yield vaults · 13th August, 2025CodebaseM-1

Summary

As per the ERC4626 spec, VaultV2::withdraw/redeem() don't receive a slippage parameter, which makes them vulnerable to slippage. This is relevant as the underlying vaults can register losses, and could surprise users redeeming who get these losses. Having a function or router that includes slippage protection could be useful for users to protect them.

Vulnerability Detail

The underlying adapters can register losses, which would be socialized among users of the VaultV2. In case one of them decides to withdraw or redeem and be frontrunned by one of these losses, they would receive a surprisingly lower amount of assets, incurring losses.

Impact

User loss on withdrawal.

Code Snippet

https://github.com/sherlock-audit/2025-08-morpho-vault-v2-aug-13th/pull/25/files#diff-b9b86210e027003894f79227889d79167f92c0aa2b2a1b0291f4606002e22540R701-R714

Tool Used

Manual Review

Recommendation

Add a function or router that includes slippage protection.