Morpho / morpho-vaults-v2

Morpho Vault v2 enables anyone to create non-custodial vaults that allocate assets to any protocols, including but not limited to Morpho Market v1, Morpho Market v2, and Morpho Vaults v1. Depositors of Morpho Vault v2 earn from the underlying protocols without having to actively manage the risk of their position. Management of deposited assets is the responsability of a set of different roles (owner, curator and allocators). The active management of invested positions involve enabling and allocating liquidity to protocols.

Morpho Vault v2 is ERC-4626 and ERC-2612 compliant. The VaultV2Factory deploys instances of Vaults v2. All the contracts are immutable.

Prize distribution and scoring

• Total Prize Pool: $ 200,000

• Additional pay for dedicated Cantina researcher: $15,000

• Primary Prize Pool: $ 192,500

• The prize distribution has 2 possible triggers:

  • If one or more valid medium severity findings are found, the total pot size is $100,000
  • If one or more valid high severity findings are found, the total pot size is $200,000

• $7,500 of the prize pot is reserved for Low Severity findings. These reports are judged based on quality and reviewers are then ranked from 1st to 5th for the purpose of prize allocation.

  • 1st: $3k
  • 2nd: $2k
  • 3rd: $1k
  • 4th: $750
  • 5th: $750

• Scoring described in the competition scoring page.

• Findings Severities described in detail on our docs page.

Documentation

Vault v2 documentation:

• Vault v2 codebase (the readme notably)

• A high level documentation of v2 vaults is available on docs.morpho.org/learn/concepts/vault-v2.

• Article introducing Morpho v2

  Vault v2 can directly or indirectly interact with other Morpho smart contracts. In particular, they can interact with Vault v1, Vault v1.1 and Market v1 smart contracts. The code and documentation for these smart contracts can be found below. We also provide a short explanation of how those smart contracts interact below. More details are given in the Vault v2 documentation as well as in the comments of the Vault v2 codebase.

Vault v1 and v1.1:

• Vault v1 codebase
• Vault v1.1 codebase
• Vault v1 and v1.1 documentation, including comprehensive comparison of v1 and v1.1.

Market v1:

• Market v1 codebase

• Market v1 documentation

  One of the main innovations of Vaults V2 is the Adapter system. An adapter is a smart contract that contains the logic to interact with a specific external protocol.
  Examples of adapters can be found in the src/adapters folder.

• MorphoMarketV1Adapter can be used to supply into a Morpho Market v1.

• MorphoVaultV1Adapter can be used to supply into a Vault v1.

  In Vault v2, the interest rate management is delegated to an external Vault Interest Controller (VIC) contract. This contract is responsible for returning the interest per second. Depending on the use case, different VIC can be used.

• The SingleMorphoVaultV1Vic should only be used for a Morpho Vault v2 that supplies exclusively to a single Morpho Vault v1. This VIC enables Vault v2 supplying exclusively into a Vault v1 to compute the interest accrual on-chain.

• The ManualVic provides greater flexibility. In the ManualVic, the Allocator is responsible for monitoring and setting the interest rate of the vault.

Scope

• Repository: https://github.com/morpho-org/vault-v2
• Commit: 5938a92 (tag: 2025-07-15)
• Total LOC: 1245
• Files: 30 (without counting interfaces)

Build Instructions

• See repo README

POC Rule

• Mandatory POC rule applies here
• See test/BaseTest.sol

Out of scope

• Automated findings by Lightchaser
• Spearbit review
• Spearbit Fix Rewiew
• Zellic audit
• Chainsecurity audit

Contact Us

For any issues or concerns regarding this competition, please reach out to the Cantina core team through the Cantina Discord.