Morpho Vault v2 Adapter Registries

Description

Both isInRegistry implementations in MorphoMarketV1Registry and MorphoVaultV1Registry do not check whether the parent vault of the adapter was deployed by a fixed designated VaultV2 factory.

Recommendation

Introduce an immutable VaultV2 factory in these contracts and in isInRegistry check that the parent vault of the adapter was deployed by that fixed VaultV2 factory.

Context: RegistryList.sol#L32-L38

Description:

In RegistryList, addSubRegistry() does not check if subRegistry already exists in the subRegistries list:

/// @dev Adding a subRegistry that reverts or makes looping too gas consuming will make new registries uneffective/// (vaults will not be able to validate adapters that would be validated by registries that have been added after).function addSubRegistry(address subRegistry) external {    require(msg.sender == owner, "Not owner");    subRegistries.push(subRegistry);    emit AddSubRegistry(subRegistry);}

As such, duplicate sub-registries can be added to the subRegistries list. However, note that there is no impact apart from isInRegistry() possibly consuming more gas.

Recommendation:

This behavior could be documented.

Morpho: Acknowledged.

Spearbit: Acknowledged.

Description

The add only assumption needs to be transitively assumed/stated/forced for sub-registries of a registry.

Recommendation

Perhaps it can be added to the documentation.