# Performance and management fee updates may technically still apply to already earned interest Low/Info · Blackthorn · Curated yield vaults · 13th August, 2025 Finding L-1 of the Morpho Vault V2 security review. - Protocol: https://morpho.org/ - Report: /reports/morpho-vault-v2 - Codebase: https://github.com/0xsimao/vault-v2/tree/ce661d820fb29307981f75eb42393db1c6e42758 - Source: https://github.com/morpho-org/vault-v2/blob/main/audits/2025-09-15-blackthorn.pdf --- ## Summary Due to the max rate mechanism, interest earned will be capped by the max rate. Thus, even if the past interest is accrued as per the rate before changing the fees, the actual interest earned that will be attributed to the Vault over time will use the new rate, but it corresponds to deposits made with the old rate. ## Vulnerability Detail `VaultV2::setPerformanceFee()` correctly accrues interest first, and only changes the fee afterwards, [link](https://github.com/sherlock-audit/2025-08-morpho-vault-v2-aug-13th/pull/25/files#diff-b9b86210e027003894f79227889d79167f92c0aa2b2a1b0291f4606002e22540R398-R403). However, note that the interest accrued is capped by the max rate, [link](https://github.com/sherlock-audit/2025-08-morpho-vault-v2-aug-13th/pull/25/files#diff-b9b86210e027003894f79227889d79167f92c0aa2b2a1b0291f4606002e22540R584). This means that the pending interest earned while the old rate was active will be now applied the new rate. ## Impact Under/over charging fees. ## Code Snippet https://github.com/sherlock-audit/2025-08-morpho-vault-v2-aug-13th/pull/25/files#diff-b9b86210e027003894f79227889d79167f92c0aa2b2a1b0291f4606002e22540R406 https://github.com/sherlock-audit/2025-08-morpho-vault-v2-aug-13th/pull/25/files#diff-b9b86210e027003894f79227889d79167f92c0aa2b2a1b0291f4606002e22540R584 ## Tool Used Manual Review ## Recommendation There are ways to fix this but not quite trivial. --- Related findings: - [Pool Delegates can set an unreasonably large delegate management fee rate at anytime](https://0xsimao.com/findings/maple-finance-iii-unreasonably-delegate-fee-anytime): Maple Finance - [`Claimers` can receive less `feePerClaim` than they should if some prizes are already claimed or if reverts because of a reverting hook](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-claimers-fee-reverts-hook): PoolTogether Prize Layer