DeFi protocol (you keep your wallet, funds sit in a smart contract)
MorphoB4/5· Medium risk
Facts last reviewed 24 Sept 2026
Morpho's core contracts have not been exploited; all incidents were in isolated markets/vaults managed by curators (Stream/xUSD 11/2025, USR 3/2026, rsETH 4/2026). Actual risk depends on the vault you choose.
Compare a move (switching cost) →History: published and paid rates, incidents, legal status →
Why this tier
- Falls short: Operating since 2024-01, under 3 years
- Meets: Audited by 5 firms: Spearbit, OpenZeppelin, Cantina, Blackthorn, Certora
- Meets: Bug bounty programme (Cantina, Immunefi, up to $2.5M)
- Meets: Large TVL: $11.2B
- Meets: No material uncovered losses in the core product (incidents in isolated products or under $1M are listed separately)
- Note: Risk of the asset itself: Isolated markets: vault depositors bear the risk of the curator's market selection, oracle configuration and collateral; bad debt is socialised into the vault's share value.
- Note: Some Gauntlet vaults affected by USR only open compensation claims when the vault runs out of liquidity; the Stream/xUSD case is still in litigation.
Tier history
- 29 Sept 2026B· Medium riskMedium risk
Products
No product of this venue is open today for this amount.