wMORPHO is research-stage software. It is not yet audited — external audits are planned before any production release. Treat it as experimental and do not deposit funds you cannot afford to lose.

• Child-vault valuation. totalAssets() sums each child's convertToAssets. The omnipool is only as safe as its child vaults, so children should themselves resist share-price manipulation. Only vaults that use the ERC4626 virtual-shares mitigation (e.g. MetaMorpho) should be onboarded, and onboarding is timelocked so a curator's choice can be reviewed and vetoed by the guardian.
• Roles. owner sets roles and the timelock; curator submits vaults, weights and caps; allocator moves funds between idle and children; guardian vetoes pending changes. Risk-increasing actions (enabling a vault, loosening a cap) are timelocked; de-risking actions are instant.
• No external price oracle. Valuation goes through each child's internal ERC4626 accounting rather than a spot AMM read, avoiding the read-only-reentrancy class of bug that has affected Curve-based allocators.

• Escrow model. Wrapping escrows MORPHO and mints a 1:1 receipt. Redemption of the underlying is disabled until enableTransfers() is called by the owner, reflecting MORPHO's own non-transferability at the time of writing.
• Reward distribution. Claimed MORPHO rewards raise the share price for all holders; because the reward token equals the underlying, no separate per-user accounting is required.

• OpenZeppelin virtual-shares ERC4626 (decimals offset 18 - assetDecimals) against inflation/donation attacks — plus a recommended deployment seed deposit.
• Reentrancy guards on every value-moving entrypoint (deposit, mint, withdraw, redeem, allocate, deallocate, rebalance, claim).
• Timelock + guardian veto on risk-increasing governance changes.
• Per-vault caps and an idle buffer.

The unit and integration suites (mock collateral, mock vaults, mock distributor) cover:

• deposits mint shares that track value; withdrawals return assets pro-rata;
• child-vault yield accrues to shareholders through the share price;
• weighted routing and net-neutral rebalancing (totalWithdrawn == totalSupplied);
• reward-integral distribution splits incentive tokens by share;
• caps bound allocation; the idle buffer is preserved;
• the inflation/donation attack leaves a later depositor's funds essentially intact;
• WMORPHO wraps 1:1, redemption is gated until enabled, and claimed rewards appreciate every holder's shares pro-rata.

Please report suspected vulnerabilities privately via a repository security advisory rather than a public issue.