Submitted by pfapostol
The StrategySupplyMorpho is designed to supply tokens to a specific market in MorphoBlue. To achieve this, it defines a _marketParams structure that stores all the necessary information for the target market, including loanToken, which is transferred from the strategy during the IMorpho.supply call.
However, the strategy also allows the deployer to specify a different token via the _asset variable. This token is used to pull tokens from users during deposits and transfer tokens to users during withdrawals.
It is unclear whether this behavior is intended by design (e.g., treating _asset as a collateral token) or if _asset is always meant to be the same as loanToken in _marketParams. Regardless, the protocol will not function if _asset is different from loanToken.
The main issue is that the _asset variable is used to approve MorphoBlue:
But later, in the _deploy call, the loanToken is used to supply to a Morpho position:
If these two tokens are different, the strategy will be unusable. Even if the design intends for _asset to act as collateral for loanTokens supplied externally (e.g., an initial supply), the protocol will still fail due to the absence of allowance for loanToken in the Morpho market.
This PoC demonstrates the following:  
In the constructor, either:  
chefkenji (BakerFi) confirmed
BakerFi mitigated:
Status: Mitigation confirmed. Full details in reports from 0xlemon and shaflow2.
