# `VaultV2::withdraw/redeem()` are vulnerable to slippage, so another function could be added to protect users Medium · Blackthorn · Curated yield vaults · 13th August, 2025 Finding M-1 of the Morpho Vault V2 security review. - Protocol: https://morpho.org/ - Report: /reports/morpho-vault-v2 - Codebase: https://github.com/0xsimao/vault-v2/tree/ce661d820fb29307981f75eb42393db1c6e42758 - Source: https://github.com/morpho-org/vault-v2/blob/main/audits/2025-09-15-blackthorn.pdf --- ## Summary As per the ERC4626 spec, [VaultV2::withdraw/redeem()](https://github.com/sherlock-audit/2025-08-morpho-vault-v2-aug-13th/pull/25/files#diff-b9b86210e027003894f79227889d79167f92c0aa2b2a1b0291f4606002e22540R701-R714) don't receive a slippage parameter, which makes them vulnerable to slippage. This is relevant as the underlying vaults can register losses, and could surprise users redeeming who get these losses. Having a function or router that includes slippage protection could be useful for users to protect them. ## Vulnerability Detail The underlying adapters can register losses, which would be socialized among users of the VaultV2. In case one of them decides to withdraw or redeem and be frontrunned by one of these losses, they would receive a surprisingly lower amount of assets, incurring losses. ## Impact User loss on withdrawal. ## Code Snippet https://github.com/sherlock-audit/2025-08-morpho-vault-v2-aug-13th/pull/25/files#diff-b9b86210e027003894f79227889d79167f92c0aa2b2a1b0291f4606002e22540R701-R714 ## Tool Used Manual Review ## Recommendation Add a function or router that includes slippage protection. --- Related findings: - [Slippage protection could be added to LoopedVault::requestWithdraw() in case of black swan event](https://0xsimao.com/findings/yieldoor-iii-slippage-withdraw-black-swan): Yieldoor LoopedVault Update - [Destination Vault rewards are not added to idleIncrease when info.totalAssetsPulled > info.totalAssetsToPull](https://0xsimao.com/findings/tokemak-rewards-info-pulled-pull): Tokemak - [`LenderCommitmentGroup_Smart_test::addPrincipalToCommitmentGroup/burnSharesToWithdrawEarnings()` are vulnerable to slippage attacks](https://0xsimao.com/findings/teller-finance-burn-shares-withdraw-slippage): Teller Finance - [Borrowing is not vulnerable to an inflation attack, it's unnecessary to borrow when initializing the vault](https://0xsimao.com/findings/fuji-finance-inflation-attack-borrow-initializing): Fuji Finance