Morpho Vault V2 Gates audit
A private security review of Morpho (lending), conducted with Sherlock and completed on 10th June 2026 over 2 days. 0xSimao's findings from it are not published individually.
What Morpho is
Morpho is an open lending stack: Morpho Blue's isolated markets pair one collateral asset with one loan asset, and Vault V2 curates deposits across them under owner, curator and allocator roles. Vault V2 also has a gate system, pluggable contracts consulted before deposits, withdrawals and share transfers.
Scope
This review covered two gate implementations in morpho-org/vault-v2: WhitelistSendAssetsGate, which restricts who may supply assets into the vault, and WhitelistReceiveSharesGate, which restricts who may end up holding vault shares. Small contracts, but they sit on the vault's only doors, so a bypass would void the whitelist guarantee an institutional deployment depends on.
The report