Skip to content

update blocksec audit report #117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MarvelFisher merged 1 commit into from
Dec 31, 2025
Merged

update blocksec audit report #117

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions docs/about-morph/10-altfeetx.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,5 +289,11 @@ sigHash = keccak256(0x7F || rlp([
]))
```

## Blocksec Audit report
We commissioned Blocksec to conduct a full security audit of Morph’s EmeraId implementation, initiated on November 24, 2025. The audit assessed the upgrade’s robustness and adherence to security best practices and was executed according to an agreed scope and testing plan tailored for this implementation.

Blocksec performed a comprehensive assessment using a white-box–led methodology designed to closely simulate real-world attack conditions. The evaluation combined black box testing, grey box testing, and white box testing techniques. The audit also incorporated analysis informed by known blockchain security vulnerabilities, alongside exploratory testing for previously unknown or emerging attack vectors.

The full audit findings and methodology are available in the official Blocksec report:
[Access the Blocksec EmeraId Audit Report](https://github.com/morph-l2/audits/blob/main/blocksec/blocksec_morph_emerald_upgrade_v1.0-signed.pdf)
Comment on lines +292 to +298

@coderabbitai coderabbitai Bot Dec 31, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix spelling errors: "EmeraId" → "Emerald" and standardize section header capitalization

The feature name is misspelled as "EmeraId" in two places (lines 293 and 298), but the actual report filename uses the correct spelling "emerald_upgrade_v1.0". Additionally, the section header uses lowercase "report" whereas the corresponding section in docs/about-morph/4-morphs-architecture.md uses uppercase "Report" for consistency.

🔎 Proposed fix 
-## Blocksec Audit report
-We commissioned Blocksec to conduct a full security audit of Morph's EmeraId implementation, initiated on November 24, 2025. The audit assessed the upgrade's robustness and adherence to security best practices and was executed according to an agreed scope and testing plan tailored for this implementation.
+## Blocksec Audit Report
+We commissioned Blocksec to conduct a full security audit of Morph's Emerald implementation, initiated on November 24, 2025. The audit assessed the upgrade's robustness and adherence to security best practices and was executed according to an agreed scope and testing plan tailored for this implementation.

-Blocksec performed a comprehensive assessment using a white-box–led methodology designed to closely simulate real-world attack conditions. The evaluation combined black box testing, grey box testing, and white box testing techniques. The audit also incorporated analysis informed by known blockchain security vulnerabilities, alongside exploratory testing for previously unknown or emerging attack vectors.

-The full audit findings and methodology are available in the official Blocksec report:
-[Access the Blocksec EmeraId Audit Report](https://github.com/morph-l2/audits/blob/main/blocksec/blocksec_morph_emerald_upgrade_v1.0-signed.pdf)
+Blocksec performed a comprehensive assessment using a white-box–led methodology designed to closely simulate real-world attack conditions. The evaluation combined black box testing, grey box testing, and white box testing techniques. The audit also incorporated analysis informed by known blockchain security vulnerabilities, alongside exploratory testing for previously unknown or emerging attack vectors.
+
+The full audit findings and methodology are available in the official Blocksec report:
+[Access the Blocksec Emerald Audit Report](https://github.com/morph-l2/audits/blob/main/blocksec/blocksec_morph_emerald_upgrade_v1.0-signed.pdf)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
## Blocksec Audit report
We commissioned Blocksec to conduct a full security audit of Morph’s EmeraId implementation, initiated on November 24, 2025. The audit assessed the upgrade’s robustness and adherence to security best practices and was executed according to an agreed scope and testing plan tailored for this implementation.
Blocksec performed a comprehensive assessment using a white-box–led methodology designed to closely simulate real-world attack conditions. The evaluation combined black box testing, grey box testing, and white box testing techniques. The audit also incorporated analysis informed by known blockchain security vulnerabilities, alongside exploratory testing for previously unknown or emerging attack vectors.
The full audit findings and methodology are available in the official Blocksec report:
[Access the Blocksec EmeraId Audit Report](https://github.com/morph-l2/audits/blob/main/blocksec/blocksec_morph_emerald_upgrade_v1.0-signed.pdf)
## Blocksec Audit Report
We commissioned Blocksec to conduct a full security audit of Morph's Emerald implementation, initiated on November 24, 2025. The audit assessed the upgrade's robustness and adherence to security best practices and was executed according to an agreed scope and testing plan tailored for this implementation.
Blocksec performed a comprehensive assessment using a white-box–led methodology designed to closely simulate real-world attack conditions. The evaluation combined black box testing, grey box testing, and white box testing techniques. The audit also incorporated analysis informed by known blockchain security vulnerabilities, alongside exploratory testing for previously unknown or emerging attack vectors.
The full audit findings and methodology are available in the official Blocksec report:
[Access the Blocksec Emerald Audit Report](https://github.com/morph-l2/audits/blob/main/blocksec/blocksec_morph_emerald_upgrade_v1.0-signed.pdf)
🧰 Tools
🪛 LanguageTool

[grammar] ~293-~293: Ensure spelling is correct
Context: ...onduct a full security audit of Morph’s EmeraId implementation, initiated on November 2...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

[grammar] ~298-~298: Ensure spelling is correct
Context: ...l Blocksec report: [Access the Blocksec EmeraId Audit Report](https://github.com/morph-...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

🤖 Prompt for AI Agents 
In docs/about-morph/10-altfeetx.md around lines 292 to 298, fix the misspelling
and header capitalization: change both occurrences of "EmeraId" to "Emerald"
(lines ~293 and ~298) to match the report filename, and update the section
header "Blocksec Audit report" to "Blocksec Audit Report" for consistency with
other docs; ensure the link text and surrounding references reflect the
corrected "Emerald" spelling.


3 changes: 3 additions & 0 deletions docs/about-morph/4-morphs-architecture.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,9 @@ We commissioned a full security audit from Sherlock, and the results are publicl

The Trail of Bits team conducted an in-depth audit of our codebase, including verification of implemented fixes. The complete report is available here [Trail of Bits Audit Report](https://github.com/morph-l2/audits/blob/main/tob/Morph%20-%20Comprehensive%20Report%20with%20Fix%20Review.pdf).

### Blocksec Audit Report:

We commissioned Blocksec to conduct a full security audit of Morph’s EmeraId upgrade. The audit assessed the upgrade’s robustness and adherence to security best practices and was executed according to an agreed scope and testing plan tailored for this implementation. The audit report is available here [Blocksec Audit Report](https://github.com/morph-l2/audits/blob/main/blocksec/blocksec_morph_emerald_upgrade_v1.0-signed.pdf).
Comment on lines +81 to +83

@coderabbitai coderabbitai Bot Dec 31, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix spelling error: "EmeraId" → "Emerald"

The feature name is misspelled as "EmeraId" but the actual report filename uses the correct spelling "emerald_upgrade_v1.0". Update the text to match.

🔎 Proposed fix 
- We commissioned Blocksec to conduct a full security audit of Morph's EmeraId upgrade. The audit assessed the upgrade's robustness and adherence to security best practices and was executed according to an agreed scope and testing plan tailored for this implementation. The audit report is available here [Blocksec Audit Report](https://github.com/morph-l2/audits/blob/main/blocksec/blocksec_morph_emerald_upgrade_v1.0-signed.pdf).
+ We commissioned Blocksec to conduct a full security audit of Morph's Emerald upgrade. The audit assessed the upgrade's robustness and adherence to security best practices and was executed according to an agreed scope and testing plan tailored for this implementation. The audit report is available here [Blocksec Audit Report](https://github.com/morph-l2/audits/blob/main/blocksec/blocksec_morph_emerald_upgrade_v1.0-signed.pdf).
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
### Blocksec Audit Report:
We commissioned Blocksec to conduct a full security audit of Morph’s EmeraId upgrade. The audit assessed the upgrade’s robustness and adherence to security best practices and was executed according to an agreed scope and testing plan tailored for this implementation. The audit report is available here [Blocksec Audit Report](https://github.com/morph-l2/audits/blob/main/blocksec/blocksec_morph_emerald_upgrade_v1.0-signed.pdf).
### Blocksec Audit Report:
We commissioned Blocksec to conduct a full security audit of Morph's Emerald upgrade. The audit assessed the upgrade's robustness and adherence to security best practices and was executed according to an agreed scope and testing plan tailored for this implementation. The audit report is available here [Blocksec Audit Report](https://github.com/morph-l2/audits/blob/main/blocksec/blocksec_morph_emerald_upgrade_v1.0-signed.pdf).
🧰 Tools
🪛 LanguageTool

[grammar] ~83-~83: Ensure spelling is correct
Context: ...onduct a full security audit of Morph’s EmeraId upgrade. The audit assessed the upgrade...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

🤖 Prompt for AI Agents 
In docs/about-morph/4-morphs-architecture.md around lines 81 to 83, change the
misspelled feature name "EmeraId" to "Emerald" so the text matches the audit
filename and correct spelling; update the heading and any occurrences within
those lines to read "Emerald" and verify the link text remains correct.


### Audit Scope:

Expand Down