MORE Optimizer audit
A private security review of More Markets (lending), conducted with Three Sigma and completed on 2nd December 2024 over 5 days. 0xSimao disclosed 13 findings: 3 high severity, 2 medium, 2 low and 6 informational.
What MORE Markets is
The MORE Optimizer consumes idle liquidity on correlated Morpho markets such as wETH and wstETH: automated collateral loops amplify yield for passive depositors while steering the underlying market toward its target utilisation, so lender rates stay competitive.
Scope
The Three Sigma review covered the optimizer pair: LoopStrategy, which opens, sizes and unwinds the leverage loops, and ProtocolFeeManager, which takes the cut.
High severity findings
- Funds may be stolen by calling onMoreFlashLoan() directly
- Malicious path can be passed to redeem/withdraw() allowing an attacker to draing the strategy
- Market interest is not always accrued
Medium severity findings
- Vault cap is not considered in the maxDeposit() calculations, which may make deposits fail
- LoopStrategy is vulnerable to inflation attacks
Low severity findings
- In case of high ltv and unfavourable swap, onMoreFlashLoan() may underflow
- LoopStrategy::totalAssets() tracks the wFlow balance, but this is not redeemable
Informational findings
- In LoopStrategy::withdraw(), _updateLastTotalAssets() is called after _withdraw()
- > should be used instead of!= in LoopStrategy::_deposit()
- Typo in LoopStrategy::_maxDeposit()
- Approval is not reset to 0 after approving the markets for wFlow assets repayment in LoopStrategy::onMoreFlashLoan()
- safeApprove() should be used instead of approve()
- paramsOfTheMarket is unused in the LoopStrategy
The report