# Wrong rounding direction for tosupply in _supplymorpho

MetaMorpho's _supplyMorpho rounds supplyAssets down when computing toSupply, so a deposit can immediately exceed the market supplyCap.

- Payout: Contest reward
- Severity: medium
- Program: Morpho Metamorpho
- Credited: Christoph Michel
- Disclosed: 2024-02-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_metamorpho_dec2023.pdf#3.1.10
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_metamorpho_dec2023%3A3.1.10
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** MetaMorpho.sol _supplyMorpho supply cap computation
**Root cause:** toSupply uses supplyCap.zeroFloorSub(supplyAssets) where supplyAssets from _accruedSupplyBalance is rounded down, understating existing supply and overestimating headroom.
**Steps:**
1. Read MetaMorpho.sol#L807 _supplyMorpho.
2. Note `(uint256 supplyAssets,,) = _accruedSupplyBalance(marketParams, id)` rounds supplyAssets down.
3. Compute `toSupply = UtilsLib.min(supplyCap.zeroFloorSub(supplyAssets), assets)`.
4. Deposit assets such that rounded-down supplyAssets leaves headroom; resulting supply exceeds supplyCap.
**How found:** Reasoned about the invariant that post-deposit supply must not exceed supplyCap, then checked rounding direction of _accruedSupplyBalance and found it rounds down where it should round up.
**Exploitation:** A depositor supplies assets sized to the under-estimated headroom, pushing the market's Metamorpho-attributed supply above supplyCap immediately after deposit.
**Insight:** When enforcing a cap via `cap - current`, the 'current' value must round up (and the subtraction's result down) or the cap can be breached by one rounding unit; audit share-to-asset conversions for direction relative to the invariant.