A formally proven core, checked against real bytecode: an honest negative on Morpho Vault V2

A negative is a real deliverable when it is backed by work on the actual code. On a mature, formally verified target the honest ceiling is often zero new findings, and the job is to confirm that against the compiled bytecode rather than to manufacture something to submit. Here is one where the ceiling was the floor, and we said so.

The thesis

The Morpho vault is a mature, heavily audited target. On a target like that, the interesting bugs are supposed to live in the least-audited seams, so that is where we aimed: adapter accounting drift between the vault and its underlying markets, rounding around the forced-deallocation penalty, and loss timing on the deposit-to-adapter path. Any of those, if it let an attacker walk away with more than they put in, is a theft.

The refutation

Two things shaped the pass. First, the pinned commit post-dates three separate audits and merges their fixes, so the obvious rounding and double-counting seams were already closed: the deallocation penalty rounds up, the adapter-list double-count and the unallocated-adapter reporting bugs are fixed, and an entire block of prior findings was mooted by removing a component wholesale. Second, the high-value invariants are formally proven: token conservation across every adapter configuration, preview equal to real, gate enforcement, reentrancy safety through the vault, and immutability with no external delegatecall. Those proofs close whole families of attack outright, which is why the taxonomy pass marked so many classes not-applicable or refuted.

We did not stop at the proofs. We compiled the actual in-scope vault and factory and tested on that bytecode:

• A forced deallocation of a large amount against a live vault with a passive co-depositor. The passive holder’s redeemable balance is unchanged and the vault stays solvent; the penalty is burned from the caller’s own shares and the assets remain in the vault.
• Five one-wei forced deallocations at a small penalty. At least one share is burned per call, so the penalty cannot be truncated to zero. The relevant prior audit fix is present.
• An adapter reporting a loss during the deposit-to-allocate path. The attacker gets back no more than they deposited; the loss is socialized onto the incumbent holder. That is the acknowledged, risk-accepted loss-timing behavior from prior audits, not an attacker-profit vector.

Across the full class taxonomy, nothing new stood up. The residual seams we examined, adapter accounting drift and shared-id cap accounting, were either conservative-for-the-vault by design, dust-scale and documented, or could at worst grief with a revert, never leak funds.

The lesson

When a target’s crown-jewel invariants are formally proven and the fixes from prior audits are present in the pinned commit, the honest ceiling is often zero. The discipline is to confirm that against the real compiled bytecode, note where the ceiling sits, and stop. Re-labeling a known, risk-accepted behavior as a fresh finding is how you burn a slot on a report that closes in a paragraph.

We filed nothing, and the negative is the result: the proven core holds on the bytecode that actually ships, and the unaudited seams do not give an attacker a profit. We kept the harness.