# MORE Optimizer audit Three Sigma · Lending · 2nd December 2024 A private security review of More Markets (lending), conducted with Three Sigma and completed on 2nd December 2024 over 5 days. 0xSimao disclosed 13 findings: 3 high severity, 2 medium, 2 low and 6 informational. ## What MORE Markets is The MORE Optimizer consumes idle liquidity on correlated Morpho markets such as wETH and wstETH: automated collateral loops amplify yield for passive depositors while steering the underlying market toward its target utilisation, so lender rates stay competitive. ## Scope The Three Sigma review covered the optimizer pair: LoopStrategy, which opens, sizes and unwinds the leverage loops, and ProtocolFeeManager, which takes the cut. ## Findings ### High - [Funds may be stolen by calling onMoreFlashLoan() directly](https://0xsimao.com/findings/more-markets-funds-stolen-calling-directly) - [Malicious path can be passed to redeem/withdraw() allowing an attacker to draing the strategy](https://0xsimao.com/findings/more-markets-path-redeem-withdraw-draing) - [Market interest is not always accrued](https://0xsimao.com/findings/more-markets-market-interest-accrued) ### Medium - [Vault cap is not considered in the maxDeposit() calculations, which may make deposits fail](https://0xsimao.com/findings/more-markets-considered-deposit-calculations-deposits) - [LoopStrategy is vulnerable to inflation attacks](https://0xsimao.com/findings/more-markets-loop-vulnerable-inflation-attacks) ### Low - [In case of high ltv and unfavourable swap, onMoreFlashLoan() may underflow](https://0xsimao.com/findings/more-markets-high-ltv-unfavourable-underflow) - [LoopStrategy::totalAssets() tracks the wFlow balance, but this is not redeemable](https://0xsimao.com/findings/more-markets-loop-tracks-balance-redeemable) ### Informational - [In LoopStrategy::withdraw(), _updateLastTotalAssets() is called after _withdraw()](https://0xsimao.com/findings/more-markets-loop-withdraw-last-called) - [> should be used instead of!= in LoopStrategy::_deposit()](https://0xsimao.com/findings/more-markets-instead-loop-strategy-deposit) - [Typo in LoopStrategy::_maxDeposit()](https://0xsimao.com/findings/more-markets-typo-loop-max-deposit) - [Approval is not reset to 0 after approving the markets for wFlow assets repayment in LoopStrategy::onMoreFlashLoan()](https://0xsimao.com/findings/more-markets-approval-approving-repayment-loop) - [safeApprove() should be used instead of approve()](https://0xsimao.com/findings/more-markets-safe-approve-instead) - [paramsOfTheMarket is unused in the LoopStrategy](https://0xsimao.com/findings/more-markets-params-market-unused-loop) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-12-02-more-markets.pdf) [Protocol](https://www.more.markets/)