Is Morpho Safe? A Security Review for Allocators

Video transcript

Is Morpho safe, including through Coinbase? Its core code is immutable and audited. The real question is your vault.

Morpho has two layers. Markets lend one asset against one collateral, on fixed terms. Vaults let a curator pick markets, and carry every one of them.

Guardian's admin key census found no upgrade path and no pause. Nobody can swap the code, or stop a failing market. Several audits and formal verification back it.

But audited code does not choose your collateral. The curator does.

Losses came from a misconfigured PAXG oracle, a manipulated LP oracle, Stream's xUSD collapse, and unbacked USR valued at one dollar. No report we found blames core code.

When USR broke, Rekt reported curators fed about 6.2 million dollars of USDC into the broken markets. Roughly 15 vaults were impacted.

Coinbase routes USDC to Steakhouse USDC, a Morpho vault on Base lending against Bitcoin and Ether tokens. About 10 percent of deposits is usually free to withdraw, and Steakhouse says the risk of being unable to withdraw is not zero.

Judge the vault, not the brand. List every market, read each oracle, check timelocks and roles, watch utilization, and study the curator's record.

Guardian's allocator ratings score each position from zero to 100, treating every market and oracle behind your vault as inherited exposure. Read the full review, or talk to Guardian.

Some lenders use Morpho without opening its app. Since September 2025, Coinbase has routed customer USDC into Morpho vaults on Base.

This guide gives no verdict on whether Morpho is safe. It covers how Morpho is built and secured, where past losses came from, and the checks to run yourself. Our Aave review takes the same approach.

How Morpho Works

Morpho has two layers: markets that lend, and vaults that choose markets.

A market lends one asset against one collateral. Its five parameters are the loan asset, collateral, oracle, interest rate model (IRM) and liquidation LTV (LLTV).

Morpho's docs say each parameter "persists in perpetuity." Anyone can create a market, but the LLTV and IRM must come from a list Morpho governance approved.

Lenders can also deposit through a vault. A curator picks its markets and caps, and allocators move funds within them.

Each market is isolated, so a bad oracle or collateral hurts only that market. A vault is exposed to every market it supplies.

Core Contract Security

Morpho's docs say "The core smart contract code is immutable."

Our admin key census read Morpho's contracts onchain and found no upgrade path and no pause. Morpho documents a 5-of-9 governance multisig; the census found 6-of-10.

Immutability cuts both ways. No one can swap the code under your deposit, and no one can pause a market that goes wrong.

Audits and formal verification

Morpho's audits page lists these reviews:

Morpho Blue's repository also holds Certora formal verification rules for accounting, liquidations, authorization, reentrancy and liveness. One rule: a borrower can always repay in full, then withdraw all collateral, "without concern for the oracle."

Where Curator Risk Sits

Audited code does not decide which collateral your deposit backs. The curator does.

Our vault curator risk guide covers how to score a curator. Most incidents below trace to three risks.

• Oracle: a price feed set up wrong, or one that cannot follow a crash.
• Collateral: a token whose backing fails while its oracle still prices it near par.
• Liquidity: withdrawals wait when a market is fully borrowed.

Past Incidents

We could source these incidents involving Morpho markets, vaults or the Morpho App.

None of these reports traces a loss to a bug in Morpho's core contracts.

Misconfigured oracles

In the PAXG case, curator LeadBlock wrote that "The oracle for the new market was incorrectly setup by our oracle provider." The Defiant tied it to wrong decimal places for PAXG relative to USDC.

LeadBlock said "No user funds were lost." A forum reply disputed that, citing about 17,800 USDC still borrowed against under $0.01 of collateral.

In May 2025, flash loans skewed an Aerodrome pool that a custom LP oracle read. Curator Clearstar Labs blamed "an LP price oracle design flaw" and covered the bad debt.

Our oracle manipulation guide explains the pattern.

The app incident

On April 10, 2025, a Morpho App update sent token approvals to the Bundler3 contract instead of its adapters. Whitehat c0ffeebabe.eth intercepted one transaction and returned the funds.

Morpho rolled back the update "within four minutes of receiving the alert." It said "All Morpho smart contracts are safe and were not affected."

Stream and Resolv

The curator risk guide covers how Stream's collapse reached Morpho vaults.

On March 22, 2026, an attacker minted about 80 million unbacked USR, The Block reported. Rekt later traced it to a compromised Resolv key.

USR and wstUSR were accepted as collateral on Morpho. Traders may have borrowed USDC against USR at its hardcoded $1 valuation, The Block reported.

Citing Chaos Labs founder Omer Goldberg, Rekt said curators fed about $6.2 million of USDC into the broken markets, 96% from Gauntlet vaults.

Morpho CEO Paul Frambot confirmed roughly 15 vaults with over $10,000 were impacted, per Rekt. Co-founder Merlin Egalite said Morpho's own contracts were unaffected.

Lending Through Coinbase

Coinbase began rolling out USDC lending through Morpho on September 18, 2025, The Block reported. Each depositor gets a smart contract wallet, and withdrawals are "subject to liquidity."

Deposits go to Steakhouse USDC, a vault on Base curated by Steakhouse Financial. Steakhouse's docs describe it:

• Collateral: cbBTC, cbETH, WETH and wstETH.
• Liquidation LTVs: 77% to 86%.
• Liquidity: Morpho markets target 90% utilization, so about 10% of deposits are usually free to withdraw.

Steakhouse adds: "the risk of complete inability to withdraw is not 0."

How to Check a Morpho Vault

Judge the vault, not the brand:

1. Name the vault and chain. Coinbase's is Steakhouse USDC on Base.
2. List every market. Know each collateral borrowers can post against your deposit.
3. Read each oracle. Is it a market feed, an exchange rate or a hardcoded value? Can it follow a depeg?
4. Check auto-allocation. Can bots keep supplying a market while it fails?
5. Read the timelock and roles. Who holds owner, curator and sentinel, and how long do risk increases wait?
6. Watch utilization. Near 100%, withdrawals wait on repayments and liquidations.
7. Read the curator's record. How did it act during the Stream and Resolv events?
8. Alert on pending changes. New markets and cap increases wait out the timelock, unless it is zero.

How Guardian Helps Allocators

Guardian's risk ratings for capital allocators underwrite a position on evidence: the deployed code, who controls it, and everything it depends on to stay solvent.

Oracles, bridges, keepers and upstream protocols are "assessed as inherited exposure." On Morpho, that means every market and oracle behind your vault.

Each position gets a score from 0 to 100, with every input visible. Guardian then watches for dependency drift, such as an oracle source swapped, and material moves reach you the day they happen.

Frequently Asked Questions

Is it safe to lend on Morpho through Coinbase?

Coinbase routes USDC into Steakhouse USDC, a Morpho vault on Base that lends against cbBTC, cbETH, WETH and wstETH. Your risk is that vault's markets, oracles and liquidity. Steakhouse says the risk of being unable to withdraw "is not 0."

Has Morpho been hacked?

No incident report we found traces a loss to a bug in Morpho's core contracts. Losses in Morpho markets came from misconfigured, manipulated or hardcoded oracles and collapsed collateral, from October 2024 to March 2026.

Can Morpho upgrade or pause its contracts?

Morpho says its core contracts are immutable, and Guardian's admin key census found no upgrade path and no pause. Governance can set a fee of up to 25% of interest and approve new LLTVs and interest rate models.

Who absorbs bad debt in a Morpho vault?

The vault's depositors. Morpho's docs say that in a Vault V2, no shares are burned and "all shareholders absorb the loss equally." Some curators have covered losses themselves, as Clearstar Labs did in May 2025.

Sources

• Morpho Docs: Audits (accessed November 6, 2026)
• Morpho Docs: Variable Rate Market (Morpho Blue)
• Morpho Docs: Governance organization
• Morpho Docs: Roles and Capabilities
• Morpho Docs: Handling Bad Debt, Morpho Vault V2
• Morpho on GitHub: morpho-blue, Certora verification README
• Morpho: Securing Morpho Midnight
• Morpho: Morpho App Incident: April 10, 2025
• Morpho: Morpho is now Powering USDC Lending on Coinbase
• Morpho forum: Retrospective: PAXG/USDC market oracle configuration, LeadBlock (October 15, 2024)
• The Defiant: Morpho User Exploits Oracle Error To Turn $350 Into $230K
• Morpho forum: Post Mortem, Aerodrome cUSDO/USDC AMM LP Oracle Manipulation, Clearstar Labs (May 26, 2025)
• Protos: High Yields to Haircuts: Has DeFi Learned Anything From Yield Vault Collapse? (November 18, 2025)
• The Block: Resolv's USR stablecoin depegs after attacker mints 80 million unbacked tokens (March 22, 2026)
• Rekt: Resolv Labs, Rekt (April 7, 2026)
• The Block: Coinbase now lets users lend USDC onchain with current yields up to 10.8% (September 18, 2025)
• Steakhouse Financial Docs: Steakhouse USDC on Coinbase
• Guardian: Who Controls DeFi? Admin Keys Behind 25 Top Protocols
• Guardian: Vault Curator Risk: What Stream Finance Taught DeFi