{"data":{"id":"pa_c6deb8adde565425","slug":"morpho-blue-base","status":"complete","visibility":"public","featured":true,"protocol":"Morpho Blue (Base)","chainId":8453,"forkBlock":"52676386","score":93,"grade":"A","summary":{"cap":null,"cases":48,"flows":{"executed":5,"requested":5},"grade":"A","score":93,"findings":{"low":4,"high":0,"info":1,"medium":2,"critical":0},"forkBlock":"52676386","carefulSuccess":5},"reportHash":"0xe4031d5037394ea11b9528ab8ea6f572fc1bf0d5d7ac2eb6e737618eaefbe1da","configHash":"0x1c9b9bc42e634779fbe3707c84ea3810effb9f7f1355e31d162eb612dd62dadc","attestation":{"uid":"0xe3da27372aa0aed55382c00f9515626e37180a13f8de9db7226dfa179de6c505","tx":"0x843b8c8ee5a3020ce058375dc8327b7d11c8feecc2cf5a3ff8e80794897e31b3","network":"eip155:11155111","url":"https://sepolia.easscan.org/attestation/view/0xe3da27372aa0aed55382c00f9515626e37180a13f8de9db7226dfa179de6c505"},"createdAt":"2026-10-16T09:09:31.245Z","startedAt":"2026-10-16T09:15:51.950Z","finishedAt":"2026-10-16T09:17:26.590Z","position":0,"error":null,"followups":[],"report":{"fork":{"block":"52676386","timestamp":"1792142119"},"score":{"cap":null,"grade":"A","total":93,"components":[{"id":"completion","title":"Task completion","detail":"5 of 5 executed flows completed by the careful agent","points":30,"weight":30},{"id":"naive_safety","title":"Safety for a naive agent","detail":"no price-sensitive flow in the config: no price-move exposure measured (full marks by construction)","points":25,"weight":25},{"id":"input_hardening","title":"Input hardening","detail":"0 of 22 weighted probe points were accepted unsafely","points":15,"weight":15},{"id":"error_legibility","title":"Error legibility","detail":"mean revert legibility 0.74 over 8 reverts raised by the protocol (5 raised by tokens not counted)","points":7.4,"weight":10},{"id":"approval_surface","title":"Approval surface","detail":"exact approvals suffice; spender is the entry contract","points":10,"weight":10},{"id":"interface_clarity","title":"Interface clarity","detail":"6 static interface finding(s)","points":6,"weight":10}]},"tasks":[{"id":"supply-usdc","args":[["0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","0x4200000000000000000000000000000000000006","0xFEa2D58cEfCb9fcb597723c6bAE66fFE4193aFE4","0x46415998764C29aB2a25CbeA6254146D50D22687","860000000000000000"],"$amountIn","0","$onBehalf","0x"],"kind":"deposit","notes":[],"title":"Deposit 1000 USDC on MorphoBlue","amount":"1000000000 base units of USDC","checks":["USDC balance decreases","supply shares increase"],"origin":"morpho-blue supply","tokenIn":{"symbol":"USDC","address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","decimals":6},"contract":"MorphoBlue (0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb)","function":"supply((address,address,address,address,uint256),uint256,uint256,address,bytes)","requires":[],"tokenOut":null,"approvals":[{"token":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","spender":"0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb"}],"instruction":"Deposit 1000 USDC into Morpho Blue (Base) (MorphoBlue at 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb on Base) so that your wallet holds a position in it. Done when your USDC balance has decreased by 1000 and your position (receipt token or recorded balance) has increased."},{"id":"withdraw-usdc","args":[["0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","0x4200000000000000000000000000000000000006","0xFEa2D58cEfCb9fcb597723c6bAE66fFE4193aFE4","0x46415998764C29aB2a25CbeA6254146D50D22687","860000000000000000"],"$amountIn","0","$onBehalf","$recipient"],"kind":"withdraw","notes":["position-reducing or borrowing flow: nothing is approved"],"title":"Withdraw 500 USDC on MorphoBlue","amount":"500000000 base units of USDC","checks":["USDC balance increases","supply shares decrease"],"origin":"morpho-blue withdraw","tokenIn":{"symbol":"USDC","address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","decimals":6},"contract":"MorphoBlue (0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb)","function":"withdraw((address,address,address,address,uint256),uint256,uint256,address,address)","requires":["supply-usdc"],"tokenOut":null,"approvals":[],"instruction":"Withdraw 500 USDC from your existing position in Morpho Blue (Base) (MorphoBlue at 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb on Base) back to your own wallet. Done when your USDC balance has increased and your position has decreased."},{"id":"collateral-weth","args":[["0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","0x4200000000000000000000000000000000000006","0xFEa2D58cEfCb9fcb597723c6bAE66fFE4193aFE4","0x46415998764C29aB2a25CbeA6254146D50D22687","860000000000000000"],"$amountIn","$onBehalf","0x"],"kind":"deposit","notes":[],"title":"Deposit 1 WETH on MorphoBlue","amount":"1000000000000000000 base units of WETH","checks":["WETH balance decreases","collateral increases"],"origin":"morpho-blue supplyCollateral","tokenIn":{"symbol":"WETH","address":"0x4200000000000000000000000000000000000006","decimals":18},"contract":"MorphoBlue (0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb)","function":"supplyCollateral((address,address,address,address,uint256),uint256,address,bytes)","requires":[],"tokenOut":null,"approvals":[{"token":"0x4200000000000000000000000000000000000006","spender":"0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb"}],"instruction":"Deposit 1 WETH into Morpho Blue (Base) (MorphoBlue at 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb on Base) so that your wallet holds a position in it. Done when your WETH balance has decreased by 1 and your position (receipt token or recorded balance) has increased."},{"id":"borrow-usdc","args":[["0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","0x4200000000000000000000000000000000000006","0xFEa2D58cEfCb9fcb597723c6bAE66fFE4193aFE4","0x46415998764C29aB2a25CbeA6254146D50D22687","860000000000000000"],"$amountIn","0","$onBehalf","$recipient"],"kind":"borrow","notes":["position-reducing or borrowing flow: nothing is approved"],"title":"Borrow 500 USDC on MorphoBlue","amount":"500000000 base units of USDC","checks":["USDC balance increases","borrow shares increase"],"origin":"morpho-blue borrow","tokenIn":{"symbol":"USDC","address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","decimals":6},"contract":"MorphoBlue (0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb)","function":"borrow((address,address,address,address,uint256),uint256,uint256,address,address)","requires":["collateral-weth"],"tokenOut":null,"approvals":[],"instruction":"Borrow 500 USDC from Morpho Blue (Base) (MorphoBlue at 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb on Base) against the collateral you have already supplied. Done when your USDC balance has increased and your debt position has increased."},{"id":"repay-usdc","args":[["0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","0x4200000000000000000000000000000000000006","0xFEa2D58cEfCb9fcb597723c6bAE66fFE4193aFE4","0x46415998764C29aB2a25CbeA6254146D50D22687","860000000000000000"],"$amountIn","0","$onBehalf","0x"],"kind":"repay","notes":[],"title":"Repay 250 USDC on MorphoBlue","amount":"250000000 base units of USDC","checks":["USDC balance decreases","borrow shares decrease"],"origin":"morpho-blue repay","tokenIn":{"symbol":"USDC","address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","decimals":6},"contract":"MorphoBlue (0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb)","function":"repay((address,address,address,address,uint256),uint256,uint256,address,bytes)","requires":["borrow-usdc"],"tokenOut":null,"approvals":[{"token":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","spender":"0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb"}],"instruction":"Repay 250 USDC of your debt in Morpho Blue (Base) (MorphoBlue at 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb on Base). Done when your USDC balance has decreased and your debt position has decreased."}],"static":[{"errors":0,"events":0,"address":"0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb","contract":"MorphoBlue","userFacing":[{"flags":["wide-tuple"],"inputs":5,"outputs":2,"selector":"0x50d8cd4b","signature":"borrow((address,address,address,address,uint256),uint256,uint256,address,address)","mutability":"nonpayable"},{"flags":["no-return","sentinel-params"],"inputs":3,"outputs":0,"selector":"0xe0232b42","signature":"flashLoan(address,uint256,bytes)","mutability":"nonpayable"},{"flags":["wide-tuple","sentinel-params"],"inputs":5,"outputs":2,"selector":"0xd8eabcb8","signature":"liquidate((address,address,address,address,uint256),address,uint256,uint256,bytes)","mutability":"nonpayable"},{"flags":["wide-tuple","sentinel-params"],"inputs":5,"outputs":2,"selector":"0x20b76e81","signature":"repay((address,address,address,address,uint256),uint256,uint256,address,bytes)","mutability":"nonpayable"},{"flags":["wide-tuple","sentinel-params"],"inputs":5,"outputs":2,"selector":"0xa99aad89","signature":"supply((address,address,address,address,uint256),uint256,uint256,address,bytes)","mutability":"nonpayable"},{"flags":["wide-tuple","no-return","sentinel-params"],"inputs":4,"outputs":0,"selector":"0x238d6579","signature":"supplyCollateral((address,address,address,address,uint256),uint256,address,bytes)","mutability":"nonpayable"},{"flags":["wide-tuple"],"inputs":5,"outputs":2,"selector":"0x5c2bea49","signature":"withdraw((address,address,address,address,uint256),uint256,uint256,address,address)","mutability":"nonpayable"},{"flags":["wide-tuple","no-return"],"inputs":4,"outputs":0,"selector":"0x8720316d","signature":"withdrawCollateral((address,address,address,address,uint256),uint256,address,address)","mutability":"nonpayable"}],"stateChanging":17,"totalFunctions":28}],"battery":{"cases":48,"agents":[{"id":"careful","title":"Careful","behaviour":"Approves exactly the amount, simulates before sending, bounds output at the quote minus 0.5%, sets a 20-minute deadline, verifies the result on chain and revokes leftover allowance."},{"id":"naive","title":"Naive","behaviour":"Approves the maximum, accepts any output, sets a far-future deadline, never simulates, trusts the transaction status."},{"id":"max-approve","title":"Max-approve","behaviour":"Careful in everything except approving the maximum and never revoking: isolates the approval surface."},{"id":"slippage-insensitive","title":"Slippage-insensitive","behaviour":"Careful in everything except accepting any output: isolates slippage exposure."},{"id":"reentrancy-probe","title":"Re-entrancy probe","behaviour":"Careful, with the transaction's call tree analysed for calls from protocol contracts back into the agent's wallet. It does not deploy attacker contracts."},{"id":"sandwich-prone","title":"Sandwich-prone","behaviour":"Bound-less, no simulation, far deadline; run after an attacker moved the pool price, then unwound by the attacker to measure extractable value."}],"mevMoveBps":100},"caveats":["This is a measurement of how scripted agents behave on a fork of the chain at one block, not a security audit and not a guarantee. It says nothing about contract bugs outside the tested flows.","The agents are deterministic scripts, not language models. Language-model agents can behave differently; an optional LLM follow-up is queued separately when requested and is not part of this score.","Everything ran on a local Anvil fork. No transaction was sent to any real network, and no real funds were used; balances on the fork are set by writing token storage.","The price-move test pushes the pool price by same-direction swaps of the agent's own trade shape until a target move is reached. It is not a mempool or builder simulation: private order flow, bundles and priority fees are not modelled.","The re-entrancy probe analyses the call tree of the agent's transaction for calls from protocol contracts into the agent's wallet. It does not deploy attacker contracts, so absence of a finding is not proof of safety.","Flows are generated from the ABI by recognising common interface shapes. Flows that could not be generated are listed under coverage and excluded from the score; a low coverage caps the grade.","ABIs come from Sourcify or Blockscout at the time of the run, not at the fork block; a registry change after the run changes the ABI hash in a re-run (the report records it).","Fork state depends on the chosen block. Reproduction needs an archive-capable RPC for that block; liquidity, rates and contract upgrades after the block are not reflected.","The Agent Readiness Score is a fixed weighting of six components (see the methodology). It orders protocols by agent-facing interface quality under this battery; it is not a risk rating of the protocol."],"metrics":{"mev":[],"flows":[{"id":"supply-usdc","kind":"deposit","title":"Deposit 1000 USDC on MorphoBlue","byAgent":{"naive":"success","careful":"success","max-approve":"success","sandwich-prone":"success","reentrancy-probe":"success","slippage-insensitive":"success"},"careful":"success","txCareful":2,"gasCareful":"168805"},{"id":"withdraw-usdc","kind":"withdraw","title":"Withdraw 500 USDC on MorphoBlue","byAgent":{"naive":"success","careful":"success","max-approve":"success","sandwich-prone":"success","reentrancy-probe":"success","slippage-insensitive":"success"},"careful":"success","txCareful":1,"gasCareful":"96092"},{"id":"collateral-weth","kind":"deposit","title":"Deposit 1 WETH on MorphoBlue","byAgent":{"naive":"success","careful":"success","max-approve":"success","sandwich-prone":"success","reentrancy-probe":"success","slippage-insensitive":"success"},"careful":"success","txCareful":2,"gasCareful":"115254"},{"id":"borrow-usdc","kind":"borrow","title":"Borrow 500 USDC on MorphoBlue","byAgent":{"naive":"success","careful":"success","max-approve":"success","sandwich-prone":"success","reentrancy-probe":"success","slippage-insensitive":"success"},"careful":"success","txCareful":1,"gasCareful":"159701"},{"id":"repay-usdc","kind":"repay","title":"Repay 250 USDC on MorphoBlue","byAgent":{"naive":"success","careful":"success","max-approve":"success","sandwich-prone":"success","reentrancy-probe":"success","slippage-insensitive":"success"},"careful":"success","txCareful":2,"gasCareful":"151692"}],"agents":[{"id":"careful","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"691544","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"none"},{"id":"naive","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"703504","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"unlimited"},{"id":"max-approve","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"703504","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"unlimited"},{"id":"slippage-insensitive","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"691460","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"none"},{"id":"reentrancy-probe","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"691544","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"none"},{"id":"sandwich-prone","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"691544","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"none"}],"probes":[{"probe":"zero-amount","title":"zero-amount","caseId":"supply-usdc.prober.zero-amount","flowId":"supply-usdc","revert":"Error(\"inconsistent input\")","verdict":"rejected"},{"probe":"dust-amount","title":"dust-amount","caseId":"supply-usdc.prober.dust-amount","flowId":"supply-usdc","revert":null,"verdict":"accepted"},{"probe":"no-approval","title":"no-approval","caseId":"supply-usdc.prober.no-approval","flowId":"supply-usdc","revert":"Error(\"transferFrom reverted\")","verdict":"rejected"},{"probe":"overspend","title":"overspend","caseId":"supply-usdc.prober.overspend","flowId":"supply-usdc","revert":"Error(\"transferFrom reverted\")","verdict":"rejected"},{"probe":"zero-amount","title":"zero-amount","caseId":"withdraw-usdc.prober.zero-amount","flowId":"withdraw-usdc","revert":"Error(\"inconsistent input\")","verdict":"rejected"},{"probe":"dust-amount","title":"dust-amount","caseId":"withdraw-usdc.prober.dust-amount","flowId":"withdraw-usdc","revert":null,"verdict":"accepted"},{"probe":"zero-recipient","title":"zero-recipient","caseId":"withdraw-usdc.prober.zero-recipient","flowId":"withdraw-usdc","revert":"Error(\"zero address\")","verdict":"rejected"},{"probe":"zero-amount","title":"zero-amount","caseId":"collateral-weth.prober.zero-amount","flowId":"collateral-weth","revert":"Error(\"zero assets\")","verdict":"rejected"},{"probe":"dust-amount","title":"dust-amount","caseId":"collateral-weth.prober.dust-amount","flowId":"collateral-weth","revert":null,"verdict":"accepted"},{"probe":"no-approval","title":"no-approval","caseId":"collateral-weth.prober.no-approval","flowId":"collateral-weth","revert":"Error(\"transferFrom reverted\")","verdict":"rejected"},{"probe":"overspend","title":"overspend","caseId":"collateral-weth.prober.overspend","flowId":"collateral-weth","revert":"Error(\"transferFrom reverted\")","verdict":"rejected"},{"probe":"zero-amount","title":"zero-amount","caseId":"borrow-usdc.prober.zero-amount","flowId":"borrow-usdc","revert":"Error(\"inconsistent input\")","verdict":"rejected"},{"probe":"dust-amount","title":"dust-amount","caseId":"borrow-usdc.prober.dust-amount","flowId":"borrow-usdc","revert":null,"verdict":"accepted"},{"probe":"zero-recipient","title":"zero-recipient","caseId":"borrow-usdc.prober.zero-recipient","flowId":"borrow-usdc","revert":"Error(\"zero address\")","verdict":"rejected"},{"probe":"zero-amount","title":"zero-amount","caseId":"repay-usdc.prober.zero-amount","flowId":"repay-usdc","revert":"Error(\"inconsistent input\")","verdict":"rejected"},{"probe":"dust-amount","title":"dust-amount","caseId":"repay-usdc.prober.dust-amount","flowId":"repay-usdc","revert":null,"verdict":"accepted"},{"probe":"no-approval","title":"no-approval","caseId":"repay-usdc.prober.no-approval","flowId":"repay-usdc","revert":"Error(\"transferFrom reverted\")","verdict":"rejected"},{"probe":"overspend","title":"overspend","caseId":"repay-usdc.prober.overspend","flowId":"repay-usdc","revert":"Panic(0x11: arithmetic overflow/underflow)","verdict":"rejected"}],"reverts":{"total":8,"byKind":{"panic":1,"error_string":7},"examples":["Error(\"inconsistent input\")","Error(\"zero address\")","Error(\"zero assets\")","Panic(0x11: arithmetic overflow/underflow)"],"external":5,"meanLegibility":0.74},"coverage":{"ratio":1,"skipped":[],"executed":5,"requested":5},"approvals":[{"flowId":"supply-usdc","spender":"0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb","naiveResidual":"115792089237316195423570985008687907853269984665640564039457584007912129639935","carefulResidual":"0","spenderUpgradeable":false},{"flowId":"collateral-weth","spender":"0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb","naiveResidual":"115792089237316195423570985008687907853269984665640564039457584007913129639935","carefulResidual":"0","spenderUpgradeable":false},{"flowId":"repay-usdc","spender":"0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb","naiveResidual":"115792089237316195423570985008687907853269984665640564039457584007912879639935","carefulResidual":"0","spenderUpgradeable":false}],"callbacks":[{"flowId":"supply-usdc","toAgent":0,"withValue":0,"callbackLoops":0,"delegateCalls":1,"contractsTouched":4},{"flowId":"withdraw-usdc","toAgent":0,"withValue":0,"callbackLoops":0,"delegateCalls":1,"contractsTouched":4},{"flowId":"collateral-weth","toAgent":0,"withValue":0,"callbackLoops":0,"delegateCalls":0,"contractsTouched":2},{"flowId":"borrow-usdc","toAgent":0,"withValue":0,"callbackLoops":0,"delegateCalls":1,"contractsTouched":9},{"flowId":"repay-usdc","toAgent":0,"withValue":0,"callbackLoops":0,"delegateCalls":1,"contractsTouched":4}]},"version":"karatum.protocol-readiness.v1","findings":[{"id":"dynamic:events-not-in-abi:MorphoBlue","fix":"Include library-defined events in the published ABI (or re-declare them in the entry contract's interface) so decoders name them.","rule":"events-not-in-abi","title":"MorphoBlue emits events that its published ABI does not describe","where":"MorphoBlue","detail":"In supply-usdc, withdraw-usdc, collateral-weth, borrow-usdc, repay-usdc the successful transaction logged events from MorphoBlue whose topics are not in the verified ABI (typically events defined in a library). An agent or indexer decoding receipts with the ABI sees raw, unnamed logs and cannot confirm what happened from the receipt.","source":"dynamic","evidence":["supply-usdc.careful.baseline","withdraw-usdc.careful.baseline","collateral-weth.careful.baseline","borrow-usdc.careful.baseline","repay-usdc.careful.baseline"],"severity":"medium"},{"id":"static:dual-denomination:MorphoBlue","fix":"Split into two functions per action (`supplyAssets`, `supplyShares`) or document the rule in each function's NatSpec and revert with a named `InconsistentInput(uint256 assets, uint256 shares)`.","rule":"dual-denomination","title":"4 functions take both assets and shares","where":"MorphoBlue.borrow, repay, supply, withdraw","detail":"MorphoBlue.borrow, repay, supply, withdraw take an `assets` and a `shares` amount of which exactly one must be zero. The ABI cannot express that; an agent that fills both, or fills the wrong one, either reverts or moves a different amount than it meant.","source":"static","evidence":[],"severity":"medium"},{"id":"static:no-custom-errors:MorphoBlue","fix":"Use named custom errors with parameters (`error InsufficientOutput(uint256 received, uint256 minimum)`) and include them in the published ABI.","rule":"no-custom-errors","title":"No custom errors in the ABI","where":"MorphoBlue","detail":"MorphoBlue publishes no `error` definitions: failures reach an agent as strings, panics or empty reverts that it cannot decode against the ABI.","source":"static","evidence":[],"severity":"low"},{"id":"static:no-events:MorphoBlue","fix":"Include every emitted event (including those defined in libraries) in the verified ABI, or emit them from the entry contract.","rule":"no-events","title":"No event definitions in the published ABI","where":"MorphoBlue","detail":"The published ABI of MorphoBlue contains no events, so a tool that decodes receipts from the ABI sees raw logs only. (The battery checks below whether the contract emits events anyway.)","source":"static","evidence":[],"severity":"low"},{"id":"static:sentinel-params:MorphoBlue","fix":"Document the neutral value in the NatSpec and the SDK, validate unexpected values with a named error, or offer an overload without the parameter.","rule":"sentinel-params","title":"5 function(s) take parameters that must stay at a sentinel value","where":"MorphoBlue.flashLoan, liquidate, repay, supply, supplyCollateral","detail":"flashLoan, liquidate, repay, supply, supplyCollateral take `data`: in the common case these must be 0 or empty, and a non-sentinel value silently changes behaviour (a price limit that partially fills, a referral id, a callback into the caller) instead of reverting.","source":"static","evidence":[],"severity":"low"},{"id":"static:wide-tuple:MorphoBlue","fix":"Publish a field-order table with units in the docs, and add a typed SDK helper; where possible give amount and limit fields distinct, self-describing names.","rule":"wide-tuple","title":"7 function(s) take wide structs","where":"MorphoBlue.borrow, liquidate, repay, supply, supplyCollateral, withdraw and 1 more","detail":"borrow, liquidate, repay, supply, supplyCollateral, withdraw and 1 more pack five or more fields (addresses, amounts and limits mixed) into one struct; positional mistakes (swapping two amounts or two addresses) are easy for an agent and invisible to the type checker.","source":"static","evidence":[],"severity":"low"},{"id":"static:no-return:MorphoBlue","fix":"Return the amounts actually moved (for example `returns (uint256 assets, uint256 shares)`).","rule":"no-return","title":"3 function(s) return nothing","where":"MorphoBlue.flashLoan, supplyCollateral, withdrawCollateral","detail":"flashLoan, supplyCollateral, withdrawCollateral return no values, so an agent cannot read what happened from the call result and must parse events or re-read state.","source":"static","evidence":[],"severity":"info"}],"protocol":{"name":"Morpho Blue (Base)","chain":"Base","chainId":8453,"docsUrl":"https://docs.morpho.org/get-started/resources/addresses/"},"caseIndex":[{"agent":"careful","probe":null,"caseId":"supply-usdc.careful.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0xfae4c622dfaaf2703776e5711b6907c250696c677c615bf836b06a1d6ce73151","condition":"baseline"},{"agent":"naive","probe":null,"caseId":"supply-usdc.naive.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0x1396cb5e2d05d864decd0553f406a3ef96f1b1dbaa7d2787820b75c568935a78","condition":"baseline"},{"agent":"max-approve","probe":null,"caseId":"supply-usdc.max-approve.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0xedd6c480ebc0d28321dafe8f349da96116a013bb27cb1b2f7b03f270660e7d7e","condition":"baseline"},{"agent":"slippage-insensitive","probe":null,"caseId":"supply-usdc.slippage-insensitive.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0x23520a717c7cbd5dc0a7cc11823fddfc2388f94441803cc7e0b1829504c524a5","condition":"baseline"},{"agent":"reentrancy-probe","probe":null,"caseId":"supply-usdc.reentrancy-probe.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0x430537af80f253ddac7ea141e3cb22c1c3998bacfcaeff15b3224bfb1fe30ab7","condition":"baseline"},{"agent":"sandwich-prone","probe":null,"caseId":"supply-usdc.sandwich-prone.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0x4d4778012b3960c10000e01047615a9abbe8d611b6c806aaa32260f3782226d2","condition":"baseline"},{"agent":"prober","probe":"zero-amount","caseId":"supply-usdc.prober.zero-amount","flowId":"supply-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x04a90a7b91c55cfe8e081ae454b784fc744f7e1106da93adee8b5ff92393f9a8","condition":"probe"},{"agent":"prober","probe":"dust-amount","caseId":"supply-usdc.prober.dust-amount","flowId":"supply-usdc","outcome":"success","verdict":"accepted","caseHash":"0x54acd62e973aede228c901a9d51d357228ba2352137ce42c7c32040f6fdca8cd","condition":"probe"},{"agent":"prober","probe":"no-approval","caseId":"supply-usdc.prober.no-approval","flowId":"supply-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x40923fdefb26eecd560a379435bd52af50abada2ab301cc4a0fee4bab91c128c","condition":"probe"},{"agent":"prober","probe":"overspend","caseId":"supply-usdc.prober.overspend","flowId":"supply-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0xd8b144615a8dbfc3a91d961ec599ac2f50b4f5946b02ca246a8fbf8f399664eb","condition":"probe"},{"agent":"careful","probe":null,"caseId":"withdraw-usdc.careful.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0xc9d74115bf94c5e766c2f697196395e59e10288ae660166528986ac6e2c9ec5f","condition":"baseline"},{"agent":"naive","probe":null,"caseId":"withdraw-usdc.naive.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0x5967e79af6015aee8412ec1fde0bfdcff34016585e8388d8ff4627cb7e2e7a0f","condition":"baseline"},{"agent":"max-approve","probe":null,"caseId":"withdraw-usdc.max-approve.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0x924fc412dffb41ed313b54a3f3e8cb543c2370b109c84cea13bfedf39628aa51","condition":"baseline"},{"agent":"slippage-insensitive","probe":null,"caseId":"withdraw-usdc.slippage-insensitive.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0xa317466242e87265d3ce4a4b655f1b97752f544b7041e9327e12f81c3c4f5989","condition":"baseline"},{"agent":"reentrancy-probe","probe":null,"caseId":"withdraw-usdc.reentrancy-probe.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0x39ba60899383a0b8f9e6bcd17e1930e018c8ab3766b00325c085c7db44648e18","condition":"baseline"},{"agent":"sandwich-prone","probe":null,"caseId":"withdraw-usdc.sandwich-prone.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0x40f5b5e4ab3986284541ec02b724690c9607aa14476770d1f3bd5f29cfb01cd3","condition":"baseline"},{"agent":"prober","probe":"zero-amount","caseId":"withdraw-usdc.prober.zero-amount","flowId":"withdraw-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x9a52d882f9afa443c6f4a0f8099e889b4112a31bfdfd92442b9565b6037789bb","condition":"probe"},{"agent":"prober","probe":"dust-amount","caseId":"withdraw-usdc.prober.dust-amount","flowId":"withdraw-usdc","outcome":"success","verdict":"accepted","caseHash":"0x8d42c554dc0c3416a2bba92976cdefe462ea2626a8d2940b65bb241da6d6b1e6","condition":"probe"},{"agent":"prober","probe":"zero-recipient","caseId":"withdraw-usdc.prober.zero-recipient","flowId":"withdraw-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x0dd8deead0da13f605f90c15bb8b1b8c49a690e57b290a6e7b532e7c02d4eabe","condition":"probe"},{"agent":"careful","probe":null,"caseId":"collateral-weth.careful.baseline","flowId":"collateral-weth","outcome":"success","verdict":"n/a","caseHash":"0x6aa85422c4094a4e164024428c7e2af8a6a43f202d502c8bb0374e2e1105a282","condition":"baseline"},{"agent":"naive","probe":null,"caseId":"collateral-weth.naive.baseline","flowId":"collateral-weth","outcome":"success","verdict":"n/a","caseHash":"0xef26ccff0af12b0004b8790f074ac5340388e21959ccde65bc08fa180d4c4fbc","condition":"baseline"},{"agent":"max-approve","probe":null,"caseId":"collateral-weth.max-approve.baseline","flowId":"collateral-weth","outcome":"success","verdict":"n/a","caseHash":"0x816d2c28c5f6022a0781a09aa9de57bc95bdd0435c11f824fe8f5357ddf7cee6","condition":"baseline"},{"agent":"slippage-insensitive","probe":null,"caseId":"collateral-weth.slippage-insensitive.baseline","flowId":"collateral-weth","outcome":"success","verdict":"n/a","caseHash":"0x2d60ffe2a0423f08d612336b1db79af3b1516be8361fdb988ff122128583ad6e","condition":"baseline"},{"agent":"reentrancy-probe","probe":null,"caseId":"collateral-weth.reentrancy-probe.baseline","flowId":"collateral-weth","outcome":"success","verdict":"n/a","caseHash":"0xff41907c5a8dba93c7c5f65dc4c3d81c40afbc120e35d6f979bec690564274b0","condition":"baseline"},{"agent":"sandwich-prone","probe":null,"caseId":"collateral-weth.sandwich-prone.baseline","flowId":"collateral-weth","outcome":"success","verdict":"n/a","caseHash":"0xd7d70e4eb8f3d8c731679998607cb29e18eb42b18f6ce96961474febbb61cda4","condition":"baseline"},{"agent":"prober","probe":"zero-amount","caseId":"collateral-weth.prober.zero-amount","flowId":"collateral-weth","outcome":"reverted","verdict":"rejected","caseHash":"0xa10a36590aeb5403e64addb3314cc731128cc8ceedd8f5441720a3ab02e79687","condition":"probe"},{"agent":"prober","probe":"dust-amount","caseId":"collateral-weth.prober.dust-amount","flowId":"collateral-weth","outcome":"success","verdict":"accepted","caseHash":"0x8e25b61df012f0b71d1bb926bf79ef760c77d0384e170b459f566cb183dc3cbf","condition":"probe"},{"agent":"prober","probe":"no-approval","caseId":"collateral-weth.prober.no-approval","flowId":"collateral-weth","outcome":"reverted","verdict":"rejected","caseHash":"0xeea54e27f9d699574e1f29e53f27c83c7fba74954725bd787e9db3cc8f448454","condition":"probe"},{"agent":"prober","probe":"overspend","caseId":"collateral-weth.prober.overspend","flowId":"collateral-weth","outcome":"reverted","verdict":"rejected","caseHash":"0xae67bb4fb58ac5039325cf25e4cabba194c5df64076261dd86b9f23b9560513d","condition":"probe"},{"agent":"careful","probe":null,"caseId":"borrow-usdc.careful.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0x4223a53f7157ea3ec62e3cae404f1a3478a72933529f7fd5cb126ee21f45f23f","condition":"baseline"},{"agent":"naive","probe":null,"caseId":"borrow-usdc.naive.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0x427e01fb448555e563ae74fe9d1b2e2f6aff5bbf2d8d125f396e67aa0067e49a","condition":"baseline"},{"agent":"max-approve","probe":null,"caseId":"borrow-usdc.max-approve.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0x30063ab5d40503955c04791bdec6bf0e622c05364a23f0d1e2a2c4ceec7dd349","condition":"baseline"},{"agent":"slippage-insensitive","probe":null,"caseId":"borrow-usdc.slippage-insensitive.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0xe9e40711ca1108056fa7e39ebc95b5b545df885055d3b7880b0fff6295e0f81b","condition":"baseline"},{"agent":"reentrancy-probe","probe":null,"caseId":"borrow-usdc.reentrancy-probe.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0xe14f0d1864fc7b0abdfbc34982e7a7ddda465bb647cd4bbe6b7f5d7d49bff1b8","condition":"baseline"},{"agent":"sandwich-prone","probe":null,"caseId":"borrow-usdc.sandwich-prone.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0xe8224eb04ec5ae04aa1cf78605f0fea10c496bdef42d27507866c2eb2d74fa74","condition":"baseline"},{"agent":"prober","probe":"zero-amount","caseId":"borrow-usdc.prober.zero-amount","flowId":"borrow-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x0b8e66f1ceb1dcc8041fe454fa28b4f52cbb210923b4fb26d7edb914c12c14b2","condition":"probe"},{"agent":"prober","probe":"dust-amount","caseId":"borrow-usdc.prober.dust-amount","flowId":"borrow-usdc","outcome":"success","verdict":"accepted","caseHash":"0x58f968e259979c523e557d2ce163392dda0f5b42f8fa4b869a8180dc7ec92596","condition":"probe"},{"agent":"prober","probe":"zero-recipient","caseId":"borrow-usdc.prober.zero-recipient","flowId":"borrow-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x7383015dd0887427b9ce04daf2e211948ab0786149f5c9d68d58e32f74e4513c","condition":"probe"},{"agent":"careful","probe":null,"caseId":"repay-usdc.careful.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0xe7553d206a3f4a5aaca30048907d789c0e497abe68196b538f80f3b41a94f2f7","condition":"baseline"},{"agent":"naive","probe":null,"caseId":"repay-usdc.naive.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0x4a2210cc5a37dcdbca1453994411f3160058b9045a83da8f11407160fecc6d48","condition":"baseline"},{"agent":"max-approve","probe":null,"caseId":"repay-usdc.max-approve.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0xc4bc36d43e6541c12ed914fc728ae50f6ec9742655509cd26067f843d776783a","condition":"baseline"},{"agent":"slippage-insensitive","probe":null,"caseId":"repay-usdc.slippage-insensitive.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0x99c80e9491ad8cb0c4425985b5a16bb04a41edf4bc532fb24a4aadd69d81a6a1","condition":"baseline"},{"agent":"reentrancy-probe","probe":null,"caseId":"repay-usdc.reentrancy-probe.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0xdeec63742db1b76222d309d6fa1a91a79e331ece475009806013eb55886e233a","condition":"baseline"},{"agent":"sandwich-prone","probe":null,"caseId":"repay-usdc.sandwich-prone.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0xdd851347a69a99403e8a2091607153c9a806da3d7358f2c5a22dec48d4813e04","condition":"baseline"},{"agent":"prober","probe":"zero-amount","caseId":"repay-usdc.prober.zero-amount","flowId":"repay-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x1c29e65117788db887d0ecc757651802151b92c78e80ae05d674de0dbf65088b","condition":"probe"},{"agent":"prober","probe":"dust-amount","caseId":"repay-usdc.prober.dust-amount","flowId":"repay-usdc","outcome":"success","verdict":"accepted","caseHash":"0x689740a185fc4ade0b6a50c3e177e95233e87b14cf1a6d282a78418fbe66c1b3","condition":"probe"},{"agent":"prober","probe":"no-approval","caseId":"repay-usdc.prober.no-approval","flowId":"repay-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0xc89901e7cf5e61ffa6b211d5840526074be5307a0d048c9f309300c8375d8081","condition":"probe"},{"agent":"prober","probe":"overspend","caseId":"repay-usdc.prober.overspend","flowId":"repay-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x74c328afdfa68b1231725dec2940af1638d7e9afd7e5732fb409da1096665bea","condition":"probe"}],"contracts":[{"name":"MorphoBlue","proxy":null,"abiHash":"0xd2cedc1019d14ea44238a1ea56a0f214d4e5e1c6ded1a85183c78dffea07877e","address":"0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb","abiMatch":"match","codeHash":"0xaa76348c0b91e5dfcece228ef6847b0c5081656d2def05c5617bcab659f0b819","codeSize":15623,"deployed":false,"abiSource":"sourcify","functions":28}],"followups":{"llmAgents":{"note":"Not requested for this audit.","status":"not_requested"}},"reproduce":{"chainId":8453,"command":"anvil --fork-url <archive RPC for chain 8453> --fork-block-number 52676386 --chain-id 8453 --port 8545 && karatum-protocol-audit run --config audit.json --rpc http://127.0.0.1:8545 --block 52676386","forkBlock":"52676386"},"strengths":["All 18 hostile-input probes (zero amount, dust, zero recipient, missing approval, overspend, past deadline, impossible minimum output, phantom token) were rejected or harmless.","Reverts are legible: mean legibility 0.74 over 8 observed reverts.","No protocol contract called into the agent's wallet during 5 traced flow(s) (call trees checked).","A careful agent completed 5/5 flows (exact approval, simulation, bounded output, on-chain verification)."],"configHash":"0x1c9b9bc42e634779fbe3707c84ea3810effb9f7f1355e31d162eb612dd62dadc","methodology":"protocol-readiness-v1"}},"disclaimer":"An Agent Readiness report measures how scripted agents (careful, naive, adversarial) behave against a protocol on a fork of the chain at one block: task completion, input hardening, price-move exposure, approval surface and error legibility. It is not a security audit or a risk rating of the protocol, and the agents are not language models. Nothing was broadcast to any real network. Methodology: docs/methodology/protocol-readiness.md."}