On a heavily-audited protocol, the repo's audits/ directory (dated PDF filenames) IS the audit-coverage timeline. Read it FIRST to locate the freshest genuinely-unaudited surface, then hunt there - do not re-audit the formally-verified core.
Two signals point at drift:
1. Newest-dated component = the most recently added module (audit lags code). Morpho: core audited through 2025-09-15 (5 firms + Certora), MarketV1AdapterV2 2025-12-04 (+Certora), gates 2026-07-08 (single auditor Blackthorn). HEAD 2026-07-31.
2. In-scope file ABSENT from every audit filename = never independently audited. Morpho src/periphery/blue-public-allocator/BluePublicAllocator.sol (147 LOC, built across Jul-2026, permissionless fund-mover) appears in NO audit report and has NO dedicated test in the repo. That is where a real bug would live if one existed.
Cross-check the audit dates against git log --since=<last-audit-date> -- src/ to see exactly what shipped after coverage.
A grep-surfaced "missing guard" is a LEAD, not a finding. Read the sink to the metal before believing it:
- Morpho: the BluePublicAllocator cap-check keys on keccak256(abi.encode("this/marketParams", adapter, mp)) - looked like a bytes32-key-confusion (cap silently a no-op). REFUTED: byte-identical to the adapter's own id; the cap binds (proven by a Foundry invariant that reverts exactly at the cap - 2048 runs).
- Gitea: codebase.go was the ONLY migration client outside the SSRF-validated transport. REFUTED: its base host is hardcoded to api3.codebasehq.com and user input only supplies 2 non-empty slash-free path fields, so baseURL.Parse can never change the host. Safe via a DIFFERENT mechanism (hardcoded host), not the named guard. Reinforces [[feedback_incompletefix_verify_guard_effect_not_presence]].
If the freshest unaudited surface keeps its security promises under a real (permissionless-attacker) Foundry invariant at 1000+ runs, and every core spec matches its NatSpec, WALK and bank the invariants. A well-audited + formally-verified + heavily-NatSpec-documented codebase (Morpho) telegraphs its residual tradeoffs in comments; undocumented drift is the target, and its absence is a legitimate result.