Here are some general guidelines for auditing any Morpho protocol:

• We omit address-zero-checks on purpose. We don’t think that it deserve a particular treatment compared to any other address misconfigurations.
• We don’t prevent no-ops: instead, we want to allow them, because it is regularly annoying when they are prevented. Please flag prevented no-ops! We don’t care about optimizing the gas of no-ops calls.
• We document supported tokens. Please ask for clarification if this documentation is not provided. Please do not spend time on issues with tokens that are out of scope.
• If there is a state S that is always bad, we should prevent reaching it if possible. But we don’t add checks that do not fully prevent reaching this state (address-zero-checks is a sub-case).
• We do not document function parameters with natspec comments when they are clear enough as-is.
• We do not try to factorize the code as much as possible. We are afraid of leaky abstractions, and factorize only when the abstractions and interfaces are very thin and scoped.
• We trade simplicity and readability for gas efficiency only for big gains (storage and contract calls mostly).
• We don’t try to make errors more explicit and have custom errors for every require.