Skip to content

Risk & Security Documentation

By using Morpho or Morpho Vaults, you assume the risks associated. The following section provides an overview of different types of risks you should be aware of when using Morpho and Morpho Vaults. This overview is not exhaustive and may not cover all potential risks to which you might be exposed. Morpho is committed to use industry-leading security practices. Yet, there are still a number of risks associated with the use of Morpho and Morpho Vaults that users must be aware of.

Morpho Security practices

Morpho is known for its industry-leading security practices and follows a multi-faceted approach to security.

Morpho security practices include formal verification, mutation tests, fuzzing, unit testing, and peer reviews that can be found within respective Github repositories. External measures include professional security reviews, contests, and pre/post-deployment bounties.

A whole article was dedicated to the Morpho Security Framework.

Over time, Morpho has been audited 27 times by 12 different security firms. This covers Morpho Optimizers, Front-ends, Morpho Vaults and Morpho, and to our knowledge, makes Morpho the most audited project in the world.

Morpho Optimizers is renowned for achieving the highest score (98%) out of 300+ protocols on DeFiSafety, an independent rating agency that assesses how closely a protocol follows best practices.

Smart Contract Risk

There is an inherent risk that the protocol could contain a smart contract vulnerability or bug.

Several security measures are employed to mitigate this risk:

Oracle Risk

Every Morpho market is connected to an oracle, established at market creation. It is important to understand that no oracle is immune to price manipulation, which can lead to liquidations or even bad debt. However, some oracles will be more resistant and resilient than others.

When assessing the reliability of an oracle, consider factors such as safety and liveness, particularly if the oracle is centralized. Also, take into account the settings and processes pertaining to the definition and frequency of price updates.

Counterparty Risk

Before entering a market, it's crucial to conduct thorough due diligence on the loan asset and the collateral asset to understand who holds power over them. Factors to consider include centralization, as a centralized governance could blacklist a specific user or even Morpho, resulting in a loss of funds. The distribution of the asset is also important, as a high concentration can cause extreme price fluctuations.

Liquidation Risk

Liquidation Risk (for borrowers)

Each Morpho market is linked to an immutable Liquidation Loan-to-Value (LLTV). If the Loan-To-Value of your position exceeds this LLTV, you will face liquidation. When borrowing on Morpho, carefully select the market and diligently manage the health of your position.

Bad Debt Risk (for lenders)

There could be circumstances in which the collateral's value for a position drops below the borrowed amount before liquidators can close the position. In such cases, the borrower holding this position has no incentive to repay the debt. Morpho has different mechanisms for accounting for bad debts. You can read more about it in the bad debt section.

Liquidity Risk (for lenders)

Liquidity refers to the access to supplied assets. A lack of liquidity can prevent suppliers from withdrawing their assets for a certain period of time. Liquidity issues are tackled through the interest rate model. Before providing liquidity, it's essential to understand the market's interest rate model. This understanding will help you estimate the level of liquidity you can expect in that market.

Morpho Vaults Specific Risks

Vault Governance Risks

Key roles within a Morpho Vault wield significant power, impacting user interests:

  • The Owner has the ability to set performance fees, appoint curators and allocators, and adjust various other settings. Morpho Vaults impose a timelock on actions that may affect users' interests.
  • The Curator can enable/disable markets. A timelock allows users to react to changes initiated by the curator.
  • The Allocators determine markets supply/withdrawal order, influencing returns and liquidity for suppliers.
  • The Guardian has the ability to revoke timelocked actions, providing an additional layer of protection for users.

When investing in a Morpho Vault, it is important to conduct thorough due diligence on the vault's settings and its allocation strategy, as well as to stay up to date with its changes.