LeadBlock's Morpho Blue Market Hack
What happened
On October 13, 2024, a borrower drained about 230,000 USDC from the Morpho Blue PAXG/USDC market after posting roughly $350 of PAXG as collateral. LeadBlock's vault allocated deposits to this market. Its oracle had been set up with the wrong decimal scaling, so it priced PAXG, a tokenized gold token, about 10^12 times too high. Chaos Labs' Omer Goldberg put gold's implied price at $2.6 trillion.
This was a market setup error, not a bug in Morpho's contracts. LeadBlock said the oracle had been set up incorrectly by its oracle provider. The market was about 4% of the vault's allocation. In its October 15 retrospective, LeadBlock said the borrowing had been fully repaid to the vault and to the lender who deposited directly, so no user funds were lost. A forum reply two days later disputed that. It said the first borrower still owed about 17.8K USDC against almost no collateral, and that 95K USDC deposited directly by 0xf9F061d9a5f04E223ed3c560E03A8AB0A70Cc1c4 had been borrowed against about $150 of collateral from three addresses. The final net loss has not been confirmed.
Borrow transaction: 0x256979ae169abb7fbbbbc14188742f4b9debf48b48ad5b5207cadcc99ccb493b, from 0x02DBE46169fDf6555F2A125eEe3dce49703b13f5.
How it happened
- The PAXG/USDC market went live with an oracle whose
SCALE_FACTORignored the 12-decimal gap between PAXG (18 decimals) and USDC (6 decimals), overvaluing PAXG by a factor of 10^12. - The borrower supplied about 0.13 PAXG (around $350) as collateral through a Morpho Bundler multicall.
- Because the oracle priced that collateral in the trillions of dollars, the 91.5% LLTV check allowed a borrow of about 230,002 USDC in the same transaction.
- Other addresses later borrowed deposited USDC against tiny collateral in the same way, according to a Morpho forum reply.
Protocol details
Evidence
- report Omer Goldberg on X: $230K Morpho PAXG/USDC Market Oracle Exploit Breakdown x.com
- transaction Etherscan transaction 0x256979ae...b493b etherscan.io
- analysis DeFiLlama defillama.com
- analysis Retrospective: PAXG/USDC market oracle configuration (LeadBlock, Morpho forum) forum.morpho.org
- analysis MorphoBlue Hack Analysis (SolidityScan) blog.solidityscan.com
- analysis Morpho Protocol Market Oracle Price Exploit (Verichains) blog.verichains.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
