morpho.org
Summary
Morpho is a modular lending protocol with ~$6.5B TVL across 37+ EVM chains, built around immutable Morpho Blue core markets and curator-managed vaults. The lending logic itself has never been directly exploited and carries tier-1 audit coverage plus Certora formal verification, but governance is concentrated in a 5-of-9 multisig with no protocol-wide timelock, permissionless oracle selection has produced recurring market-level losses (~$480K in Oct 2024), and seven cross-chain deployments lack block-explorer verification. Overall risk is moderate (4.8/10).
Trust Assumptions
Depositors trust that the 5-of-9 governance multisig (0xcBa28…9AFa on Ethereum/Base) will honor off-chain Snapshot votes and not unilaterally upgrade the MORPHO token, reconfigure LayerZero bridge peers, or raise protocol fees without community notice. Users in specific Morpho Blue markets must trust that each market's oracle—often a permissionless MorphoChainlinkOracleV2 wrapping Chainlink feeds without staleness checks—is correctly configured by the market creator or vault curator. Vault depositors additionally trust individual curators and owners to set safe collateral parameters, timelocks, and adapter allowlists independent of protocol governance.
What Could Go Wrong
A misconfigured or manipulable oracle on a permissionless market could again enable undercollateralized borrowing, as seen in the Oct 2024 PAXG/USDC exploit (~$230K) and May 2025 Aerodrome LP manipulation (~$49K bad debt). A compromise of five multisig signers would allow immediate, timelock-free upgrades to the MORPHO token proxy, fee-parameter changes on Morpho Blue, and LayerZero setPeer reconfiguration that could mint unbacked cross-chain tokens. Third-party contagion—such as the Mar 2026 Resolv USR depeg affecting ~15 vaults via Public Allocator automation—can route vault capital into broken markets even when core contracts operate as designed.
Recommendation
Morpho Blue core lending is suitable for institutional-scale allocation when users stick to well-audited vaults and markets with established Chainlink oracles and reputable curators (e.g., Coinbase, Gemini integrations). Avoid obscure permissionless markets with custom oracles. Monitor multisig signer composition, cross-chain contract verification status (7 of 26 tracked instances remain unverified), MORPHO vesting unlocks (~11.6M tokens/month through April 2028), and any governance proposal to activate the fee switch or upgrade token logic. Reduce exposure to vaults with aggressive Public Allocator automation during external stablecoin or bridge stress events.
Key Findings (30)
Analysis Sections
Morpho uses off-chain Snapshot voting (500k MORPHO threshold) with on-chain execution by a verified 5-of-9 Gnosis Safe at 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa on Ethereum and Base. Core Morpho Blue lending logic is immutable; governance controls IRM/LLTV whitelisting, fee switches, the upgradeable MORPHO token, LayerZero bridge config, and MorphoRegistry. No protocol-wide timelock protects multisig actions. Arbitrum Morpho Blue is owned by a separate Safe deployment (0xfd358f49678bd408fbce0cf6bb9dfa5857d5d9b2) with identical 5/9 signers.
Findings (9)
The primary 5/9 Gnosis Safe can execute privileged actions immediately once threshold signatures are collected. There is no on-chain TimelockController or Safe module enforcing a delay between vote passage and execution. This applies to Morpho Blue owner functions (enableIrm, enableLltv, setFee, setFeeRecipient), MORPHO token upgrades, LayerZero bridge configuration, and MorphoRegistry updates.
The MORPHO token on Ethereum (0x58D97B57BB95320F9a05dC918Aef65434969c2B2) is an ERC1967 upgradeable proxy. owner() resolves to the governance multisig, granting the ability to upgrade token logic without a timelock. Base MORPHO (0xBAa5CC21fd487B8Fcc2F632f3F4E8D37262a0842) shares the same owner.
While Ethereum and Base share the canonical governance multisig at 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa (verified 5/9, identical signers), Arbitrum Morpho Blue owner() points to a distinct Safe at 0xfd358f49678bd408fbce0cf6bb9dfa5857d5d9b2. On-chain verification confirms this Arbitrum Safe has the same 9 owners and threshold of 5, but the address divergence increases operational risk and audit surface across 37+ deployed chains where ownership may not be uniformly verified.
Governance proposals are voted on via Snapshot (morpho.eth space) with a 500k MORPHO proposal threshold, but execution relies on the 5/9 multisig voluntarily honoring off-chain results. There is no on-chain Governor contract binding vote outcomes to execution, creating a trust gap between token-holder signaling and privileged on-chain actions.
The Ethereum LayerZero OFT adapter (0x50d3d6fD7518682155E3C1B65FDD50e1b35649D9) owner() is the governance multisig, granting setPeer, setDelegate, and rate-limit configuration powers. The Arbitrum bridge was proactively suspended following the April 2026 Kelp DAO/LayerZero incident, indicating ongoing operational dependency on multisig discretion for cross-chain MORPHO transfers.
Discovery labels the Ethereum rewards multisig as 3/5, but on-chain verification shows 0xF057afeEc22E220f47AD4220871364e9E828b2e9 is a 3-of-7 Gnosis Safe. Base rewards multisig (0x5Eb982bb1E620cC3927E5CF8A5D207e667643297) is correctly 3/5. Documentation inconsistency reduces transparency for rewards distribution governance.
Morpho Blue market logic (supply, borrow, liquidate, flashLoan) has no upgrade path. The owner role is limited to whitelisting IRMs and LLTVs, setting per-market fees (capped at 25%), changing fee recipient, and transferring ownership. Market creation is permissionless once IRM/LLTV/oracle are enabled.
MetaMorpho Factory, Oracle Factory, VaultV2 Factory, and PublicAllocator have no protocol-level owner. Anyone can deploy vaults, oracles, and use the public allocator. Risk is compartmentalized to individual vault curators/owners who set their own timelocks and roles.
MetaMorpho V1.1 and Vault V2 vaults delegate risk management to per-vault owners, curators, allocators, and sentinels. Vault V2 supports configurable timelocks per function selector and abdication of privileged roles. This isolates vault risk from protocol governance but means depositors must assess individual vault governance.
Governance Checklist
Verified Multisig Configuration
| Multisig | Chain | Address | Threshold | Owners |
|---|---|---|---|---|
| Governance | Ethereum | 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa | 5/9 | 9 (verified on-chain) |
| Governance | Base | 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa | 5/9 | 9 (same signers as ETH) |
| Morpho Blue Owner | Arbitrum | 0xfd358f49678bd408fbce0cf6bb9dfa5857d5d9b2 | 5/9 | 9 (same signers, different Safe) |
| Rewards | Ethereum | 0xF057afeEc22E220f47AD4220871364e9E828b2e9 | 3/7 | 7 (verified on-chain) |
| Rewards | Base | 0x5Eb982bb1E620cC3927E5CF8A5D207e667643297 | 3/5 | 5 (verified on-chain) |
On-Chain Ownership Map (Verified Contracts)
| Contract | Chain | Controller | Type |
|---|---|---|---|
| Morpho Blue | Ethereum | 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa | 5/9 Multisig |
| Morpho Blue | Base | 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa | 5/9 Multisig |
| Morpho Blue | Arbitrum | 0xfd358f49678bd408fbce0cf6bb9dfa5857d5d9b2 | 5/9 Multisig (distinct address) |
| MORPHO Token | Ethereum | 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa | 5/9 Multisig (upgradeable proxy) |
| MORPHO Token | Base | 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa | 5/9 Multisig |
| LayerZero OFT Adapter | Ethereum | 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa | 5/9 Multisig |
| MorphoRegistry | Ethereum | 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa | 5/9 Multisig |
| Oracle/MetaMorpho/VaultV2 Factories | Ethereum | None | Permissionless |
| PublicAllocator | Ethereum | None (per-vault admin) | Permissionless |