Morpho security record
As of 29 Oct 2026, Morpho has 20 audit reports by 3 security firms on Trustblock; the latest is by Cantina, dated 21 Sep 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits20
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Morpho: VaultV2 + MorphoVaultV1Adapter | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Morpho VaultV2 configs FeeWrapper | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Morpho Midnight Core [8de7076] | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Morpho Midnight | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Morpho: Midnight | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Morpho: Midnight - BlueBuyCallback [93db7e08] | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Morpho Vault v2 & Blue IRM | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Morpho Vaults v2 | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Morpho Vault v2 Adapter Registries | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Web3 Security Review: Morpho Bundler3 | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| bundler-v3 | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| morpho-token-upgradeable | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Morpho Pre-Liquidation audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| morpho-pre-liquidation | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| metamorpho | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| morpho-blue-oracles adapters | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| morpho-blue-oracles | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| morpho-blue-bundlers | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| public-allocator | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Morpho (Aave v3) | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
Findings112
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 17 | 4 |
| Low | 3 | 54 | 33 |
Marked Informational or Gas Optimization by the firms. Not counted as findings.
InformationalPotential discrepancies between previewRedeem , redeem and withdrawMorpho: VaultV2 + MorphoVaultV1Adapter · Cantina · 21 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalVaultV2 allocation to a general ERC-4626 via MorphoVaultV1AdapterMorpho: VaultV2 + MorphoVaultV1Adapter · Cantina · 21 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalAllocation mechanism in the presence of allocatorsMorpho VaultV2 configs FeeWrapper · Cantina · 11 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalForceDeallocate Is Required on Child Vault to Exit Parent in Illiquid StatesMorpho VaultV2 configs FeeWrapper · Cantina · 11 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalDeviation in oracle price could lead to arbitrage in high LLTV marketsMorpho Midnight · Cantina · 10 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalEcrecoverRatifier.isRatified(...) 's check can be strengthenedMorpho Midnight Core [8de7076] · Cantina · 10 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalLenders can wash-transfer credit after a fee cut to reset fixed future continuous feesMorpho Midnight · Cantina · 10 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalProvide the caller to all callback hooksMorpho Midnight Core [8de7076] · Cantina · 10 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalBlueBuyCallbackFactory should revert when incorrectly configuredMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalConsider reducing the complexity of BlueBuyCallback flows derived by unrestricted delegation on Blue positionsMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
InformationalExecute allowance approval only when tokens will be actually pulled by MidnightMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalOffers in midnight using BlueBuyCallback can be forced to revert by draining Morpho Blue liquidityMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalsetAuthorization and setAuthorizationWithSig should not allow the OWNER to remove self-unauthorizeMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalInconsistency in marketIds array when burnShares is calledMorpho Vault v2 & Blue IRM · Cantina · 15 Dec 2025Acknowledged
The report gives no description here.
Open the reportInformationalDuplicateMorpho Vault v2 Adapter Registries · Cantina · 2 Oct 2025Acknowledged
The report gives no description here.
Open the reportInformationalLEGACY_MORPHO and NEW_MORPHO could be defined as IERC20morpho-token-upgradeable · Cantina · 5 Nov 2024Acknowledged
The report gives no description here.
Open the reportInformationalMisleading comments related with ERC20Wrapper and ERC20WrapperBundler inside the Wrappermorpho-token-upgradeable · Cantina · 5 Nov 2024Acknowledged
The report gives no description here.
Open the reportInformationalMissing version field in the MorphoTokenEthereum and MorphoTokenOptimismmorpho-token-upgradeable · Cantina · 5 Nov 2024Acknowledged
The report gives no description here.
Open the reportInformationalDifferent SafeTransferLib has been used compared to morpho-bluemorpho-pre-liquidation · Cantina · 29 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalIterative pre-liquidationmorpho-pre-liquidation · Cantina · 29 Oct 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
InformationalSolidity versionmorpho-pre-liquidation · Cantina · 29 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalConfusing use of uint184 and uint196 types for pending valuesmetamorpho · Cantina · 24 Sep 2024Acknowledged
The report gives no description here.
Open the reportInformationalInconsistent use of msg.sendermetamorpho · Cantina · 24 Sep 2024Acknowledged
The report gives no description here.
Open the reportInformationalConsider adding a pausable feature to reallocateTo is triggerable only by one of Morpho's guardianspublic-allocator · Cantina · 10 May 2024Acknowledged
The report gives no description here.
Open the reportInformationalConsider renaming allocator config variables and functions to be more vault specificpublic-allocator · Cantina · 10 May 2024Acknowledged
The report gives no description here.
Open the reportInformationalNatSpec documentation issues: missed parameters, typos or suggested updatesmorpho-blue-bundlers · Cantina · 10 May 2024Acknowledged
The report gives no description here.
Open the reportInformationalCanceled root check occurs after Merkle proof verificationMorpho Midnight · Cantina · 10 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalMinor Issues - MidnightMorpho Midnight Core [8de7076] · Cantina · 10 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalThe offer tree construction should be also highlighted in EcrecoverRatifier.isRatified(...)Morpho Midnight Core [8de7076] · Cantina · 10 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalBlueBuyCallback lacks a skim endpoint for stranded assetsMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalBlueBuyCallback natspec should be further expandedMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalBlueBuyCallbackFactory.createBlueBuyCallback should track the msg.senderMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalbuyerAssetsBound should document if the callback contract can be configured as a BLUE fee recipientMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalConsider documenting the token assumptions made by safeApproveMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalConsider using on demand exact allowance approval when onBuy is executedMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalcreateBlueBuyCallback() reverts if an owner already has BlueBuyCallback deployedMorpho: Midnight - BlueBuyCallback [93db7e08] · Cantina · 3 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalBurned shares can't be recovered if market gets back to healthy state againMorpho Vault v2 & Blue IRM · Cantina · 15 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalSub-registries could break the add-only assumption for adaptersMorpho Vault v2 Adapter Registries · Cantina · 2 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalEthereumGeneralAdapter1.stakeEth() is wrongly marked as payablebundler-v3 · Cantina · 2 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalMinor issues with code and commentsbundler-v3 · Cantina · 2 Jan 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalRisks of unlimited approval of external contracts by adaptersbundler-v3 · Cantina · 2 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalA prefix can be added to the namespaced storage layout's idmorpho-token-upgradeable · Cantina · 5 Nov 2024Fixed
The report gives no description here.
Open the reportInformationalMissing function to get the current implementationmorpho-token-upgradeable · Cantina · 5 Nov 2024Fixed
The report gives no description here.
Open the reportInformationalTypo in the DelegationTokenmorpho-token-upgradeable · Cantina · 5 Nov 2024Fixed
The report gives no description here.
Open the reportInformationalUse init functions provided by the Open-Zeppelin contractsmorpho-token-upgradeable · Cantina · 5 Nov 2024Fixed
The report gives no description here.
Open the reportGas OptimizationThe LTV-dependant ratio calculation in preLIF and preLCF can be refactormorpho-pre-liquidation · Cantina · 29 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalIncomplete documentation of totalAssets behaviormetamorpho · Cantina · 24 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalMissing new owner powers in documentationmetamorpho · Cantina · 24 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalSpec mismatch for ERC20Permit string namemetamorpho · Cantina · 24 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalAdd a specific test that uses vaults for both BASE_VAULT and QUOTE_VAULT in MorphoChainlinkOracleV2Testmorpho-blue-oracles · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalConsider documenting that WstEthEthExchangeRateChainlinkAdapter returns the conversion rate of wstETH/stETH and not wstETH/ETHmorpho-blue-oracles adapters · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportInformationalConsider tracking the msg.sender in the event emitted by the PublicAllocator contractpublic-allocator · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportGas OptimizationConsider using stETH.getPooledEthByShares directly instead of passing through wstETHmorpho-blue-oracles adapters · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportInformationalImprove the NatSpec documentation about latestRoundData return valuesmorpho-blue-oracles adapters · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportInformationalMore event parameters can be declared as indexedpublic-allocator · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportInformationalNatSpec documentation issues: missed parameters, typos or suggested updatesmorpho-blue-oracles · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportInformationalNatSpec documentation issues: missed parameters, typos or suggested updatespublic-allocator · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportInformationalPublicReallocateTo event is emitted with the wrong parameters orderpublic-allocator · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportInformationalVault's flow caps should be constrained by the vault's state and configurationpublic-allocator · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportInformationalWST_ETH should be declared constant and hardcoded at compilation timemorpho-blue-oracles adapters · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportShow 1 more
InformationalWstEthEthExchangeRateChainlinkAdapter can only be deployed and used on Ethereum Mainnetmorpho-blue-oracles adapters · Cantina · 10 May 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="morpho"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us