Morpho
Bounty Range
$1,000 - $2,500,000
external program
/opportunities/leaderboard[/welcome](Discover Cantina)
[/login](Log in)[/signup](Sign up)
@morpho Live
https://x.com/Morphohttps://github.com/morpho-orghttps://morpho.org
Maximum reward
$2,500,000
Severity
Max. Reward
Critical$2,500,000
High$50,000
Medium$10,000
Low$3,000
No deposit required
Findings submitted
457
Start date
27 Mar 2024
Please sign in as a researcher to join the bounty.
[/login](Log in)
?overviewTab=0&assetGroup=0?overviewTab=1&assetGroup=0
Morpho is an open lending network, powered by various protocols (listed below), that connects lenders and borrowers to the best opportunities globally. Businesses integrate Morpho's neutral infrastructure to power lending or borrowing products at scale, including embedded crypto-backed loans and earn products.
Morpho V2 follows a similar architecture to Morpho V1, featuring two protocols: Morpho Markets V2, a protocol for fixed-rate, fixed-term loans (not yet live), and Morpho Vaults V2, a more general lending vault architecture that can allocate to any protocol via adapters.
Morpho V1: A dual-layer permissionless architecture consisting of Morpho Markets V1 (otherwise known as Morpho Blue), a protocol for creating simple lending markets, and Morpho Vaults V1 (otherwise known as MetaMorpho), a protocol for building lending vaults exclusively on top of Markets V1.
[Deprecated] Morpho V0: A peer-to-peer optimization layer built on top of existing lending protocols, designed to improve the rate users receive while maintaining the same risk parameters.
For more information about Morpho, please visit https://morpho.org/ Morpho provides rewards in USDC on Ethereum, denominated in USD. For more details about the payment process, please view the Severity and Reward levels below.
Name (address link) | Repo | https://etherscan.io/address/0xA1D94F746dEfa1928926b84fB2596c06926C0405 | https://github.com/morpho-org/vault-v2/tree/2f0c4a3885160371369362f624d2a6e9c94c399a/src | https://etherscan.io/address/0x32BB1c0D48D8b1B3363e86eeB9A0300BAd61ccc1 | https://github.com/morpho-org/vault-v2/tree/21910a002d69ca27b0b622a64c30e7d6e4b49e6c/src | https://etherscan.io/address/0xD1B8E2dee25c2b89DCD2f98448a7ce87d6F63394 | https://github.com/morpho-org/vault-v2/tree/2f0c4a3885160371369362f624d2a6e9c94c399a/src | [https://etherscan.io/address/0x3696c5eae4a7ffd04ea163564571e9cd8ed9364e](Morpho Registry) | https://github.com/morpho-org/vault-v2-adapter-registries/tree/d3b239ba9445099fba19109629d9bb9c7c4709f9/src |
Name (address link) | Repo | [https://etherscan.io/address/0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb](Morpho Blue) | https://github.com/morpho-org/morpho-blue/tree/55d2d99304fb3fb930c688462ae2ccabb1d533ad | [https://etherscan.io/address/0x870aC11D48B15DB9a138Cf899d20F13F79Ba00BC](Adaptive Curve Irm) | https://github.com/morpho-org/morpho-blue-irm/tree/a7d9cce3451b4a106bfd40933ac57a785b5228f3 | [https://etherscan.io/address/0x3A7bB36Ee3f3eE32A60e9f2b33c1e5f2E83ad766](Morpho Chainlink Oracle V2 Factory) | https://github.com/morpho-org/morpho-blue-oracles/tree/7d638ad5f6d7dd1c2355b42aaca406f0531161f6/src/morpho-chainlink | https://github.com/morpho-org/pre-liquidation/tree/main | https://github.com/morpho-org/pre-liquidation/tree/main |
Name (address link) | Repo | [https://etherscan.io/address/0xa9c3d3a366466fa809d1ae982fb2c46e5fc41101](MetaMorpho Factory) | https://github.com/morpho-org/metamorpho/tree/c5e758da97d210ede921bf228d37d31e744bd5bf | [https://etherscan.io/address/0xfd32fA2ca22c76dD6E550706Ad913FC6CE91c75D](Public Allocator) | https://github.com/morpho-org/public-allocator/tree/1994f575aed4097196108f83ee19ca9fb59e6cba/src | [https://github.com/morpho-org/metamorpho-v1.1](Metamorpho v1.1) | https://github.com/morpho-org/metamorpho-v1.1 |
Name (address link) | Repo | [https://etherscan.io/address/0x5148bF15bb722E1854F66430Bc9FeD0E9FDaCE7D](Market Rewards Program Registry) | https://github.com/morpho-org/morpho-blue-rewards-emissions/blob/c3517486aaca8090f016b8f18f52b1cc63fa16f0/src/MarketRewardsProgramRegistry.sol | [https://etherscan.io/address/0xf27fa85b6748c8a64d4b0d3d6083eb26f18bde8e](Rewards Emission Data Provider) | https://github.com/morpho-org/morpho-blue-rewards-emissions/tree/4a46c679ce2b8ed1f263a82e2e78fcf3faf3ca2c | [https://etherscan.io/address/0x9baA51245CDD28D8D74Afe8B3959b616E9ee7c8D](Universal Rewards Distributor Factory) | https://github.com/morpho-org/universal-rewards-distributor/blob/efa8c4a842222cd214b8c25d8f2173bc41dedc1f/src/UrdFactory.sol |
Name (address link) | Repo | https://etherscan.io/address/0xa7995f71aa11525db02fc2473c37dee5dbf55107 | https://github.com/morpho-org/morpho-blue-bundlers/tree/5466a6bedc5c9afc37584c0515ddaf51fc095370 | https://etherscan.io/address/0xb3dcc75db379925edfd3007511a8ce0cb4aa8e76 | https://github.com/morpho-org/morpho-blue-bundlers/tree/5466a6bedc5c9afc37584c0515ddaf51fc095370 | https://etherscan.io/address/0x98ccb155e86bb478d514a827d16f58c6912f9bdc | https://github.com/morpho-org/morpho-blue-bundlers/tree/5466a6bedc5c9afc37584c0515ddaf51fc095370 | https://etherscan.io/address/0x98ccb155e86bb478d514a827d16f58c6912f9bdc | https://github.com/morpho-org/morpho-blue-bundlers/tree/5466a6bedc5c9afc37584c0515ddaf51fc095370 | https://etherscan.io/address/0x26bf52a84360ad3d01d7cdc28fc2ddc04d8c8647 | https://github.com/morpho-org/morpho-blue-bundlers/tree/5466a6bedc5c9afc37584c0515ddaf51fc095370 | https://etherscan.io/address/0x3a0e2e9fb9c95fbc843daf166276c90b6c479558 | https://github.com/morpho-org/morpho-blue-bundlers/tree/5466a6bedc5c9afc37584c0515ddaf51fc095370 |
Bundler3
Name (address link) | Repo | https://etherscan.io/address/0x6566194141eefa99Af43Bb5Aa71460Ca2Dc90245 | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 | https://etherscan.io/address/0x03b5259Bd204BfD4A616E5B79b0B786d90c6C38f | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 | [https://etherscan.io/address/0xb09e40EbE31b738fbf20289270a397118707D475](AaveV3MigrationAdapter “Core”) | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 | [https://etherscan.io/address/0x2CC8d502a65824B4cF9A58DB03490bA024BDB806](AaveV3MigrationAdapter “Prime”) | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 | [https://etherscan.io/address/0x4011dc6581fA05F9B0c7A12AdCd676e2b1a59ca3](AaveV3MigrationAdapter “EtherFi”) | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 | https://etherscan.io/address/0xdBa5bdE29eA030Bfa6A608592dFcA1D02CB26773 | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 | https://etherscan.io/address/0x9e2ea2d5785598a163D569D795f286F5C55ad972 | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 | https://etherscan.io/address/0x40288815C399709dFC0875A384B637fFe387961B | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 | https://etherscan.io/address/0x9B89c07f480Df1945279031b5fC6fF241b8f1101 | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 | [https://etherscan.io/address/0x4A6c312ec70E8747a587EE860a0353cd42Be0aE0#code](EthereumGeneralAdapter1(specific to Ethereum)) | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 | [https://basescan.org/address/0xb98c948CFA24072e58935BC004a8A7b376AE746A#code](GeneralAdapter1(for all other networks)) | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 | [https://etherscan.io/address/0xf83D17dFE160597b19e4FdD8ea61A23e9a87F962#code](ERC20WrapperAdapter(on Base and Ethereum only for now))) | https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3 |
Please find the relevant addresses listed here: https://docs.morpho.org/addresses/
SeverityLevel | Impact: Critical | Impact: High | Impact: Medium | Impact: Low | Likelihood: High | Critical | High | Medium | Low | Likelihood: Medium | High | High | Medium | Low | Likelihood: Low | Medium | Medium | Low | Informational |
Details on Bounty severity classification: https://docs.cantina.xyz/cantina-docs/cantina-bounties/bounty-severity-classification
Severity | Reward Amount | Critical | $2,500,000 | High | $50,000 |
Critical:
Market V1 contracts (Morpho-blue, Morpho-blue-irm):
Up to $2,500,000, minimum payout $250,000
Vault V2, Vault V1 and other contracts:
Up to $1,500,000, minimum payout $150,000
High:
Up to $50,000, minimum payout $10,000
Medium:
Up to $10,000, minimum payout $3,000
Low:
Up to $3,000, minimum payout $1,000
Severity | Reward Amount | Critical | $50,000 | High | $5,000 |
Critical:
Morpho (app.morpho.org)
Up to $50,000, Minimum payout $10,000
Max payout of $50,000 applies if the attack results in loss of funds without any user interaction or any other attack gaining unauthorizes access to funds
All other impacts would be capped at $10,000 for critical severity
All other apps
Up to $10,000, Minimum payout $5,000
Max payout of $10,000 applies if the attack results in loss of funds without any user interaction or any other attack gaining unauthorizes access to funds
All other impacts would be capped at $5,000 for critical severity
To participate in this program, security researchers must comply with the rules of engagement and must not:
Be listed on OFAC's SDN list
Have been an official contributor, either past or present
Be employees or individuals closely associated with the project
Be security auditors who directly or indirectly participated in the audit review Morpho will require KYC information for processing payments on successful bug submissions. The following details must be provided:
Full name
Date of birth
A copy of your passport or other government-issued ID To be eligible for a reward under this Program, you must:
Discover a previously-unreported, non-public vulnerability that is not previously known by the Morpho team and is within the scope of this Program
Be the first to disclose the unique vulnerability, in compliance with the disclosure requirements.
Not submit a vulnerability caused by an underlying issue that is the same as an issue on which a reward has been paid under this Program.
Provide sufficient information to enable our engineers to reproduce and fix the vulnerability.
Not exploit the vulnerability in any way, including through making it public or by obtaining a profit (other than a reward under this Program).
Not publicize or exploit a vulnerability in any way, other than through private reporting to us
Refrain from any privacy violations, destruction of data, interruption or degradation of any of the assets in scope.
Not engage in any unlawful conduct when disclosing the bug, including through threats, demands, or any other coercive tactics.
Comply with all the rules of the Program, including but not limited to, refraining from engaging in any Prohibited Actions.
Live testing on public chains, including public mainnet deployments and public testnet deployments.
We recommend testing on local forks, for example using foundry.
Public disclosure of bugs without the consent of the Morpho team.
Conflict of Interest: any individual who is or has ever been employed by Morpho may not participate in the Bug Bounty. Additionally, any individual who has been involved in or contributed to the development of the code of the bug in question may not participate in the Bug Bounty.
The vulnerability must not be disclosed publicly or to any other person, entity or email address before Morpho has been notified, has fixed the issue, and has granted permission for public disclosure.