MorphoConnector Manual Review Findings

MCR-01M: Potential Token Incompatibility

Type	Severity	Location
Standard Conformity		MorphoConnector.sol:L87

Description:

Certain non-standard tokens will disallow an allowance of 0 to be configured as an optimization, such as the Ethereum main-net BNB variant.

Example:

Copy
77function repay(
78    address target,
79    uint256 amount,
80    bytes memory extraData
81) external payable override {
82    MorphoExtraData memory data = abi.decode(extraData, (MorphoExtraData));
83    SafeTransferLib.safeApprove(data.marketParams.loanToken, target, amount);
84    IMorpho(target).repay(
85        data.marketParams, 0, data.shares, address(this), ""
86    );
87    SafeTransferLib.safeApprove(data.marketParams.loanToken, target, 0);
88}

Recommendation:

We advise the code to either accommodate for such non-standard tokens or to note that they are not supported explicitly, either of which we consider an adequate alleviation of this exhibit.

Alleviation (6ab7af3bb495b817ffec469255ea679b1813eecb):

The vfat team evaluated this exhibit and clarified that they are aware of this issue and intend to acknowledge that certain non-standard tokens will not work with their system.