✨ adapter: use morpho flash loans

[patitonar]

Summary by CodeRabbit

• New Features
  • Flash loans now use Morpho, supporting single-token loans and integration with debt rolling.
  • Added Morpho deployment addresses for Base and Optimism.
• Bug Fixes
  • Updated inverse price-feed calculations to use a squared base unit and retain upward rounding. Invalid or excessively high decimal values continue to fail safely.

[changeset-bot]

🦋 Changeset detected

Latest commit: 8d411b6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@exactly/protocol	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9cbac092-57f9-44b2-8b43-0e803eb92778

📥 Commits

Reviewing files that changed from the base of the PR and between 8695ffc and 8d411b6.

📒 Files selected for processing: 5

• .gas-snapshot
• contracts/PriceFeedInverse.sol
• contracts/periphery/FlashLoanAdapter.sol
• test/FlashLoanAdapter.t.sol
• test/PriceFeedInverse.t.sol

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

FlashLoanAdapter replaces its Balancer V3 integration with Morpho flash loans. Deployment configuration adds Morpho addresses for Base and Optimism. Tests cover loan handling, callback authorization, and a DebtRoller integration. PriceFeedInverse now uses a squared base unit to calculate its inverse answer.

Changes

Morpho Flash-Loan Adapter

Layer / File(s)	Summary
Implement Morpho-backed loans contracts/periphery/FlashLoanAdapter.sol	The adapter requests a single-token loan from Morpho, forwards the borrowed amount to the recipient callback, and approves Morpho for repayment. It exposes the token balance held by Morpho through available.
Wire Morpho deployments deploy/FlashLoan.ts, deployments/base/Morpho.json, deployments/optimism/Morpho.json, deployments/base/Balancer3Vault.json	The deployment script now uses Morpho and skips deployment when Morpho is absent or the network is sunset. Morpho addresses are added for Base and Optimism, and the Balancer vault address file is removed.
Validate loans and integration test/FlashLoanAdapter.t.sol, .gas-snapshot	Tests cover USDC and WETH loans, request validation, callback authorization, and rolling a fixed USDC borrow through DebtRoller. The gas snapshot records adapter test entries and updated measurements for other tests.
Record the adapter release change .changeset/brave-lions-swim.md	The Changeset declares a patch release for @exactly/protocol and describes adapter use of Morpho flash loans.

Inverse Price Feed

Layer / File(s)	Summary
Calculate the inverse from a squared base unit contracts/PriceFeedInverse.sol, test/PriceFeedInverse.t.sol, .gas-snapshot	PriceFeedInverse replaces baseUnit with baseUnitSquared and uses it to calculate the rounded-up inverse answer. Tests cover the squared base unit, constructor overflow, and the zero-answer error.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~30 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant FlashLoanAdapter
  participant Morpho
  participant Recipient
  Caller->>FlashLoanAdapter: Request a single-token flash loan
  FlashLoanAdapter->>Morpho: Request token and amount with encoded payload
  Morpho->>FlashLoanAdapter: Call onMorphoFlashLoan
  FlashLoanAdapter->>Recipient: Transfer borrowed token
  FlashLoanAdapter->>Recipient: Call receiveFlashLoan with zero fee
  FlashLoanAdapter->>Morpho: Approve repayment

Loading

Merge Risk: ⚪ Minimal · up to 8d411

This change moves flash loans to Morpho and adjusts the inverse price feed calculation. No actionable merge-blocking risk was identified in the supplied review context.

Security architecture risk: 🟡 Moderate · up to 8695f

The new loan flow has callback protections and integration tests, but an existing Base deployment may remain on the old provider unless the adapter and its dependent DebtRoller are migrated together. The deployed provider’s behavior has not been independently verified.

Retained concerns

• Medium · reliability · inferred: An existing Base installation can retain its Balancer adapter by default; moving DebtRoller to the new provider requires a separately controlled upgrade of its immutable adapter binding. An incomplete migration could leave the intended Morpho flow unused or interrupt debt rolls.

Security review details

Security Blast Radius

• inferred — The new trusted-provider boundary is each deployed adapter’s immutable Morpho address. A wrong registry binding would affect loans routed through that adapter; the supplied source does not independently establish deployed contract identity at both network addresses.

Security Findings and Attack Paths

• inferred — No introduced authorization exploit is established: arbitrary callers could already request loans for arbitrary recipients, and DebtRoller checks both its configured adapter and active callback data. Whether other deployment states or provider behavior change effective exposure remains unresolved.

Trust Boundaries and Controls

• observed — The adapter authenticates the callback sender but does not independently compare the callback’s amount argument with the encoded request. Its settlement relies on Morpho collecting the approved repayment after the recipient returns.

Resilience and Maintainability Implications

• observed — DebtRoller consumes its active callback hash before changing market state. The Optimism-fork test asserts that Morpho is repaid and its adapter allowance is consumed, but does not prove those properties for every deployment or adversarial provider behavior.

Hardening Proposals

• proposed — Verify the provider code and repayment semantics at each configured address, then plan and check the adapter and DebtRoller migration together, including recovery if only one deployment step completes.

Pre-merge checks: 4

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: replacing the flash-loan adapter implementation with Morpho flash loans.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8695ffc69e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.80%. Comparing base (2e0b944) to head (8d411b6).

Additional details and impacted files

@@                 Coverage Diff                 @@
##           inverse-price-feed     #817   +/-   ##
===================================================
  Coverage               94.80%   94.80%           
===================================================
  Files                      32       32           
  Lines                    2751     2732   -19     
  Branches                  368      365    -3     
===================================================
- Hits                     2608     2590   -18     
+ Misses                    142      141    -1     
  Partials                    1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T19:50:07.058266Z	8d411b6	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.