# Insufficient non existent token check can be weaponised

SafeTransferLib lacks code-existence check, letting an attacker supply a not-yet-deployed token to inflate internal balance and later drain victim deposits.

- Payout: Contest reward
- Severity: high
- Program: Morpho Blue
- Credited: kankodu
- Disclosed: 2024-09-28
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_blue_dec2023.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** SafeTransferLib.sol / Morpho Blue supply and supplyCollateral
**Root cause:** SafeTransferLib.sol does not verify that the token address has deployed code, so safeTransferFrom against a codeless address returns success instead of reverting.
**Steps:**
1. Predict a token's future address via frontrunning its deployment tx or CREATE2.
2. Call `createMarket` with that address as loanToken, plus a legitimate oracle and IRM.
3. Call `supply` with an arbitrary large amount; the codeless token makes safeTransferFrom a no-op, but internal balance is credited.
4. After the token deploys and victims deposit real loanTokens, withdraw the inflated balance to drain them.
5. Repeat with `supplyCollateral` for the collateralToken.
**How found:** Code review of SafeTransferLib.sol noticing absence of an extcodesize/code check, then reasoning that a pre-deployment token address makes transfers no-op while accounting still credits balance.
**Exploitation:** Attacker frontruns a token deployment, creates a market referencing the not-yet-deployed token, supplies an unbounded amount (transfer silently succeeds against codeless address), then withdraws real deposits once victims fund the market.
**Escalation:** Same primitive applies to both loanToken supply and collateralToken supplyCollateral, widening drainable value.
**Insight:** In lending/accounting protocols, check whether token transfer helpers verify code existence; any market creation that accepts arbitrary token addresses before deployment enables phantom-balance inflation.