Morpho Vault V2 audit

A private security review of Morpho Vault V2 (curated yield vaults), conducted with Blackthorn and completed on 13th August 2025 over 8 days. 0xSimao disclosed 6 findings: 1 medium, 4 low and 1 informational.

What Morpho Vault V2 is

Morpho Vault V2 lets anyone deploy a non-custodial, ERC-4626 and ERC-2612 compliant vault that allocates assets across protocols, Morpho Market v1 and v2 and Vault v1 included, through immutable contracts deployed by the VaultV2Factory. Depositors earn from the underlying venues without managing positions themselves.

Scope

The Blackthorn review covered the Vault V2 core: the owner, curator and allocator role split, the adapters translating vault allocations into per-protocol positions, and the id-based cap system limiting exposure to any one venue.

Medium severity findings

• VaultV2::withdraw/redeem() are vulnerable to slippage, so another function could be added to protect users

Low severity findings

• Performance and management fee updates may technically still apply to already earned interest
• Performance and management fees could round up to protect the protocol
• Adapters could store the index instead of true in the VaultV2 to remove the O(n) search
• A deallocateAll() function could be useful to successfully guarantee market removal in the Morpho market adapter

Informational findings

• submit() could be more verbose when a selector has been abdicated

The report

Download report (PDF)